DATASHEETTripwire Enterprise &Tripwire LogCenter
Integrated for Unparalleled Cyberthreat Detection
The Tripwire Enterprise andTripwire LogCenter integration
provides unparalleledenterprise threat intelligence,
giving rich context aroundchanges and security events inyour environment, right out ofthe box.

Tripwire provides out-of-the-box integration of Tripwire® Enterprise, a
security configuration management solution, and Tripwire LogCenter®, acomplete log management and SIEM solution. By joining these solutions, you
can automatically correlate changes detected in Tripwire Enterprise with log
and event data captured by Tripwire LogCenter.
Combined, they grant immediate visibility to file and configuration changes,
along with information about the context
in which those changes were made. Thisadded risk context helps security professionals prioritize changes based onrisk to the business.
By joining forces, Tripwire Enterpriseand Tripwire LogCenter offer visible,
actionable intelligence with several outof-the-box, real-time integration points:

Change/Event Correlation
Provides Change and Risk
Context
Any SIEM can detect a security event.
It’s far more powerful when a SIEM canshow you that there’s a relationshipbetween an event and an unexpectedchange to a critical file or setting. This
reduces false positives and focuses yourincident detection efforts on the events
that actually matter.
The out-of-the-box integration between
Tripwire Enterprise and Tripwire
LogCenter automatically correlateschanges that impact policies with events
detected by Tripwire LogCenter. By
providing this real-time visibility intochanges and their context through consoles and dashboards, it’s far easier toidentify impending threats.

Bi-Directional Context Enables
Forensic Discovery andInvestigation
Quickly find vulnerabilities, respondto attacks and recover from breaches.
The integration between Tripwire
Enterprise and Tripwire LogCenter provides contextual controls that give you
unprecedented levels of visibility andintelligence. For example, in Tripwire
Enterprise you can investigate suspicious activity on a server, device orother IT asset by seeing related security
events from Tripwire LogCenter—allwithout leaving the console you workfrom most. Similarly, from Tripwire
LogCenter you can view the Tripwire
Enterprise asset associated with an
event of interest to inspect potentiallyrelated changes detected on that asset.

Global Event Search
Reveals Trends and Threats
Save time by obtaining more accurate
and comprehensive results from yourqueries. Identify unexpected threat patterns faster. In Tripwire Enterprise you
can now execute standards-based queries against log and event information
captured by Tripwire LogCenter. This canprovide hard evidence of a threat to backup a gut suspicion. It can also reveal
an anomaly that may indicate the seeds

FOUNDATIONAL CONTROLS FORSECURITY, COMPLIANCE & IT OPERATIONSFig. 1 Tight integration between Tripwire LogCenter and Tripwire Enterprise automatically shows the relationship between an
event of interest and an unexpected change to a critical file or that impacts policies.
of a coordinated attack. For example,
you can query for all files changed by aspecific user or for “portmap scanning”
messages that can reveal an external
threat.

Tripwire LogCenter “EventWidget” Displays Real-TimeInformation

The Tripwire Enterprise andTripwire LogCenter Integration in Action
Tripwire Enterprise indicates that a file share’s configuration settings havebeen changed to allow anyone to access critical data anonymously. Wheneversomeone accesses this file share, Tripwire LogCenter sends you an alert.
Clearly there’s a problem. To fix the problem, you return the configuration
to its previously known and trusted state using automated remediation in
Tripwire Enterprise. In this case, it fixes the configuration setting so thatit prohibits guests and unauthorized users from accessing the files. andrequires each user to authenticate to view the material. The next time an
unauthorized user or perpetrator tries to login to the system, access isdenied. Problem solved.

Save time finding security incidents andout-of-compliance status. A Tripwire
LogCenter event widget can now beplaced in Tripwire Enterprise dashboards (Fig. 1) to provide real-time event
information from Tripwire LogCenter
for monitored servers, applications anddevices. Status updates to these eventsare made in Tripwire Enterprise andthen updated in Tripwire LogCenter uponsynchronization.

Hyperlogging Rapidly
Re-Enables Critical Logs That
Have Been Disabled

Plus, Tripwire Enterprise and Tripwire
LogCenter continue monitoring theinfrastructure to protect critical files
and systems, detect incidents at the
speed of change, and remediate issues
before damage is done.

Reduce the risk associated withgaps in logging coverage and satisfy
requirements for logging continuity.
Hyperlogging rapidly and automaticallyre-enables logging of critical logs thathave been disabled—an action hackers
or malicious insiders often take to cover

their tracks. Tripwire Enterprise detects
when logging systems in Tripwire
LogCenter have been disabled and
immediately re-enables them. It also
provides reports to auditors and realtime alerts of compliance violations.Fig. 2 The integration of Tripwire Enterprise and Tripwire LogCenter lets you correlate detailed system configuration state andchange data with log and event data.

Tripwire Enterprise Agents
Deliver Instant Log DataTMENGEAANMVU
LN
ERAWEB
APPLICATIONSCANNINGATION

SECURITYINTELLIGENCE

E

N

A

ONTE

RP

OM
UTTI

SEYA

LOG
MANAGEMENT

RI

RIT

SIEM

IN T

SECU

EGR

FILE
INTEGRITYMONITORING

VULNERABILITYASSESSMENT

EMENT
NAG
MA

POLICYMANAGEMENTTY
LI
BI

SECURITY CONFIGURA
TI
ONNESS CONTEXT
BUSI

LOG
IN

T E LLIG E NCEFig. 3 Tripwire solutions include Tripwire LogCenter for log and event management,
Tripwire Enterprise for security configuration management and Tripwire IP360™ forvulnerability management. With Tripwire you gain system state intelligence that lets
you prioritize risk and protect your high value, mission-critical assets.

Enable deep logging on different systems without difficult, manual efforts.
The integration helps you meet thislongstanding log management needmuch more easily. Take advantage ofTripwire Enterprise agents that arealready deployed to immediately senddetailed system state, change andconfiguration information to Tripwire
LogCenter. If you’re an existing Tripwire
Enterprise user, you can obtain thisinstant logging capability with a simple
console upgrade if your deployed agentsare version 7.5 or higher.

Tripwire is the trusted leader for establishing a strong cybersecurity foundation. We protect the world’s
leading organizations against the most damaging cyberattacks, keeping pace with rapidly changing techcomplexities to defend against ever-evolving threats for more than 20 years. On-site and in the cloud, ourdiverse portfolio of solutions find, monitor and mitigate risks to organizations’ digital infrastructure—allwithout disrupting day-to-day operations or productivity. Think of us as the invisible line that keeps
systems safe. Learn more at tripwire.com
The State of Security: News, trends and insights at tripwire.com/blog
Connect with us on LinkedIn, Twitter and Facebook©2021 Tripwire, Inc. Tripwire, LogCenter, IP360, Tripwire Axon and others are trademarks or registered trademarks of Tripwire, Inc. All other product and company names areproperty of their respective owners. All rights reserved.
TETLCI1k1407