Working with Notifications

If a Correlation RuleConstructed with a flowchart consisting of an Input, DecisionA component of a Correlation Rule, a Decision defines a condition that determines if the rule continues correlating a log message.(s), and Output(s), a CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Rule correlates log messages to identify events of interest. creates a Correlated EventAn event of interest identified by the Correlation Engine., and the rule has a Notification ActionA type of ActionA TLC object that initiates a response to Correlated Events created by Correlation Rules. that creates a Notification in the Notifications dialog of the TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data.. as an Output, TLC adds an event notification in the TLC Console of each user specified by the Action.

To configure a Notification Action, see Working with Actions.

To add a Notification Action as an Output in a Correlation Rule, see Defining a Correlation Rule.

Tips

Each day, TLC removes the oldest notifications that exceed the number specified by the System DatabaseInstalled on your Primary Manager, the System Database stores a record of all user logins and logouts, as well as all TLC objects defined in the TLC Console; for example, Monitored Assets, NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Rules, and Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source. Tickets - Maximum number of Notifications advanced setting in the Manager's properties dialog (see Changing a Manager's Advanced Settings). Since TLC experiences performance degradation when the total number of Event Tickets and notifications exceeds 5,000, Tripwire recommends that you monitor the number of tickets and notifications in your TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation.. For more information about Event Tickets, see Working with Event Tickets.

To view your notifications in the TLC Console:

1.

In the button bar, clickDisplay notifications.

2.

In the Notifications panel at the bottom of the TLC Console, TLC presents the notifications for your user account (see Table 106).

If the Correlation Rule that generated a notification also saved the Correlated Event in an Event-Management DatabaseAn optional component of your TLC environment, an Event-Management Database stores Events. Types of Event-Management Databases include Event Databases, IDS Databases, and Firewall Databases., you can view the properties of the event by double-clicking the notification.

To limit the number of Notifications listed, enter a value in the Notification(s) to display field.

To acknowledge all Notifications, clickAcknowledge all notifications in the database.

To remove a notification, select the notification and clickRemove selected notifications.

To remove all notifications for the current user, clickRemove all notifications.

To refresh the Notifications panel, clickRefresh notifications.

3.

To close the Notifications panel, clickDisplay notifications.

Table 106. Columns in the Notifications panel

Column	Description
Priority	The Priority of the notification specified in the Action Settings tab of the Correlation Rule (see Table 98).
Notified	The recipients of the notification specified by the Notification Action (see Working with Actions).
Timestamp	The date and time when TLC generated the notification.
Manager	The Manager with the Correlation EngineThe component of your Primary ManagerEach TLC environment has a single Primary Manager that controls: 1. The storing of log messages in the Audit LoggerThe TLC Console component in which you can work with the log messages collected by TLC. File Store and Events in Event-Management Databases, 2. The configuration settings for your TLC environment, and 3. User access and license management for TLC. responsible for identifying events of interest. To correlate events, the Correlation Engine applies Correlation Rules to the Normalized Messages received from the Normalization Engine. that generated the notification.
Item ID	If the Correlation Rule also saved the notification's Correlated Event to an Event-Management Database, this field provides the unique ID assigned to the event by TLC.
Message	The content of the notification specified in the Action Settings tab of the Correlation Rule (see Table 98).