Overview

Presents an overview of the selected Event. For field descriptions, click here.

Event. The description of the Event.

Time. The time when the Event was saved in the Event DatabaseA type of Event-Management Database that stores Events from any Log SourceAny log-generating application, operating-system service, database instance, or device from which TLC collects log messages. and/or scannerA device that monitors systems in your TLC environment (for example, a vulnerability scanner)...

Legacy ClassificationThe process of categorizing log messages with Classification Tags.. A category for the Event.

Type. The type of system on which the Event occurred.

Count. The total number of events that comprise the Event, as determined by the Event's Correlation RuleConstructed with a flowchart consisting of an Input, DecisionA component of a Correlation Rule, a Decision defines a condition that determines if the rule continues correlating a log message.(s), and Output(s), a CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Rule correlates log messages to identify events of interest.. For example, if the rule creates an Event when 5 failed logins occur, this field will have a value of 5.

Sensor. The Log Source's Monitored AssetAn object in the TLC Configuration Manager that represents a Log Source from which TLC collects log messages directly..

Priority. The severity of the Event: High, Medium, Low, or Info.

Threat. The Priority specified by the Correlation Rule that created the Event.

IDS Details. If the Event was originally stored in an IDS DatabaseA type of Event-Management Database that stores Events from IDS and IPS devices., pulls all of the Event's information from the database.

Event Details. Opens the Event Details tab (see Table 112).

Details

Presents the values of fields in the Event. For field descriptions, click here.

Event ID. A unique ID for the Event.

Normalization RuleDefines a regular expression that can be used to normalize log messages generated by a specific type of Log Source. ID. The ID of the NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Rule that normalized the Event. To open the rule's properties dialog, clickRule ID (see Working with Normalization Rules).

Correlation Rule ID. The ID of the Correlation Rule that correlated the Event (if applicable). To open the rule's properties dialog, clickRule ID (see Working with Correlation Rules).

Global ID. A unique ID for the Event that applies to both the Audit LoggerThe TLC Console component in which you can work with the log messages collected by TLC. and the Event-Database Viewer.

ActionA TLC object that initiates a response to Correlated Events created by Correlation Rules.. The Event action, such as permit, drop or log.

User and Process. The user and process identified by the Normalized MessageA log messageA data record generated by a Log Source and collected by TLC. that has been normalized by TLC. from which TLC created the Event.

Reference and Value. The associated event reference and value (if applicable). For more information about event references, see Table 109. 

Classification

Presents any Classification Tags associated with the Event.

Source Address

If the communication Event originated from an IP address in the Src IP field and the IP address is in the Hosts group in the Event-Database Viewer (see Working with the Event-Database Viewer), this tab presents the following fields. (Otherwise, the Source Address tab is disabled.)

IP Address. The IP address in the Src IP field (i.e., the system that initiated the communication).

Country. The country in which the system with the IP address is located.

Port. The Source Port from which the initiating system sent the communication.  

Hostname. The system's host name. 

OS. The system's operating system.

. Resolves the values in the IP Address and/or Hostname fields.

If resolution is successful, TLC updates these fields with the new value(s).

Otherwise, TLC enters N/A. 

. Adds a new host to the Event Database based on the information in this tab. (If the database already contains the host, this button is disabled.)

. If the Event Database contains the host, click this button to populate this tab with further details from the database. Otherwise, this button is disabled. 

Destination Address

If the communication Event was received by an IP address in the Dst IP field and the IP address is in the Hosts group in the Event-Database Viewer (see Working with the Event-Database Viewer), this tab presents the following fields. (Otherwise, the Destination Address tab is disabled.)

IP Address. The IP address in the Dst IP field (i.e., the system that received the communication).

Country. The country in which the system with the IP address is located.

Port. The Destination Port on which the system received the communication. 

Hostname. The system's hostname. 

OS. The system's operating system.

. Resolves the values in the IP Address and/or Hostname fields.

If resolution is successful, TLC updates these fields with the new value(s).

Otherwise, TLC enters N/A. 

. Adds a new host to the Event Database based on the information in this tab. (If the database already contains the host, this button is disabled.)

. If the Event Database contains the host, click this button to populate this tab with details of the host. Otherwise, this button is disabled. 

Event Tickets

Presents any Event Tickets associated with the Event. For more information, see: 

Working with Event Tickets in the Event-Database Viewer

Acknowledging Event Tickets

Overview

Presents the values of fields in the Event. For field descriptions, click here.

Event ID. A unique ID for the Event.

Global ID. A unique ID for the Event that applies to both the Audit Logger and the Event-Database Viewer.

Normalization Rule ID. The ID of the Normalization Rule that normalized the Event. To open the rule's properties dialog, clickRule ID (see Working with Normalization Rules).

Correlation Rule ID. The ID of the Correlation Rule that correlated the Event (if applicable). To open the rule's properties dialog, clickRule ID (see Working with Correlation Rules).

Src IP and Port. If an Event involves a communication between two systems, the IP address and port of the system that initiated the communication. Otherwise, the IP address of the system on which the Event occurred.

Dst IP and Port. If an Event involves a communication between two systems, the IP address and port of the system that received the communication.

Tip: To open an IP address for the Src IP field or Dst IP field in the TLC Internet ToolsA TLC Console component in which you can run queries with conventional utilities to gather information about Hosts (e.g. NSLookup, Ping, Traceroute, and Whois). dialog, click(see Working with Internet Tools).

Src DNS and Dst DNS. The DNS names for the systems cited in the Src IP and Dst IP fields.

Time. The time when the Event was saved in the Event Database.

Protocol. The protocol used if an Event involves a communication between two systems.

Sensor. The Log Source's Monitored AssetA Log Source in your TLC environment. See Monitored Assets and Discovered Assets..

Legacy Classification. A category for the Event.

Type. The type of system on which the Event occurred.

Priority. The severity of the Event: High, Medium, Low, or Info.

Threat. The Priority specified by the Correlation Rule that created the Event.

Action. The Event action, such as permit, drop or log.

User and Process. The user and process identified by the Normalized Message from which TLC created the Event.

Count. The total number of events that comprise the Event, as determined by the Event's Correlation Rule. For example, if the rule creates an Event when 5 failed logins occur, this field will have a value of 5.

Email. Sends the Event to specified recipients via email.

Search. Opens the Search feature in the TaskCreated and configured in the Task Manager, a Task queries Events, Hosts, or Scanner Events in an Event-Management Database to perform an operation. Types of Tasks include Layout-Panel, Administrative, and Search Tasks. Manager. TLC auto-populates the Filter Wizard tab with conditions for the Event's properties. For further details, see Working with the Task Manager.

IDS Details. If the Event was originally stored in an IDS Database, pulls all of the Event's information from the database.

Copy Details. Copies the properties of the Event to your clipboard.

Print Details. Generates an Event Detail Report. For more information, see Working with Report Output.

Classification

Presents any Classification Tags associated with the Event.

Destination Address

If the Event has an IP address in the Dst IP field and the IP address is in the Hosts group in the Event-Database Viewer (see Working with the Event-Database Viewer), this tab presents the following sub-tabs. (Otherwise, the Destination Address tab is disabled.)

Overview tab. General information about the Host1. A Log Source or a system involved in an Event. 2. A system on which TLC Manager, TLC Console, or Event-Management Database software is installed. with the IP address.

Applications tab. Applications installed on the Host with the IP address.

Vulnerabilities tab. Related Scanner Events (see What are Scanner Events?).

Event Tickets tab. Lists any Event Tickets with which the Host is currently associated.

Source Address

If the Event has an IP address in the Src IP field and the IP address is in the Hosts group in the Event-Database Viewer (see Working with the Event-Database Viewer), this tab presents the following sub-tabs. (Otherwise, the Source Address tab is disabled.)

Overview tab. General information about the Host with the IP address.

Applications tab. Applications installed on the Host with the IP address.

Vulnerabilities tab. Related Scanner Events (see What are Scanner Events?).

Event Tickets tab. Lists any Event Tickets with which the Host is currently associated.

Event References

Opens a built-in browser in which you can query more information about the Event Reference associated with the Event (if applicable). For more information about event references, see Table 109.