Working with Event Tickets in the Event-Database Viewer

This topic explains how to:

Create a new Event TicketA work ticket for an Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source. in an Event-Management Database. for an Event, Host1. A Log Source or a system involved in an Event. 2. A system on which TLC Manager, TLC Console, or Event-Management Database software is installed., or Scanner EventAn Event created when you import data from a scannerA device that monitors systems in your TLC environment (for example, a vulnerability scanner). to an Event Database..

Assign an Event, Host, or Scanner Event to an existing Event Ticket.

Remove an Event, Host, or Scanner Event from an Event Ticket.

For more information about Event Tickets, see Working with Event Tickets.

To work with Event Tickets in the Event-Database Viewer:

1.

In the side bar, select Events >Event-Database ViewerA type of Database ViewerA TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can review information about Events in Event-Management Databases. Types of Database Viewers include the Event-Database Viewer, IDS-Database Viewer, and Firewall-Database Viewer. in which you can query and work with the data in your Event Databases..

2.

In the side bar of the Event-Database Viewer, select an option to display items in the main pane.

To display Events, select Events, an Event-field value under List Events, or a Search.

To display Hosts, select Hosts or a Host-field value under Hosts.

To display Scanner Events, select Vulnerabilities or a scanner-field value under Vulnerabilities.

Tip	For Event-field descriptions, click here.

3.

To create a new Event Ticket for an Event(s):

a.

In the main pane, select the Event(s).

b.

In the button bar, clickTicketing > Create Ticket to open the Ticket tab. For further instructions, see Working with Event Tickets.

To assign an item(s) to an existing Event Ticket:

a.

In the main pane, select the item(s).

b.

In the button bar, clickTicketing > Add to Existing Ticket.

c.

Enter search criteria for the ticket in the Search field and drop-down, and click Search.

d.

Select the ticket and click Add.

To remove an item(s) from an existing Event Ticket:

a.

In the main pane, select the item(s). TLC presents the Details panel at the bottom of the Event-Database Viewer.

Tip	If the Event Ticket iconappears in one of the following columns in the main pane, the item is currently assigned to a ticket. The Event Name column of an Event The Host Name column of a Host The Vulnerability Name column of a Scanner Event To open the ticket, select the item and click Ticketing > View Ticket in the button bar of the Event-Database Viewer.

b.

In the Event Tickets tab of the Details panel, select the ticket and click Remove.

c.

In the confirmation dialog, click Yes.