REPORT CATALOG

Tripwire State Analyzer
Report Catalog

FOUNDATIONAL CONTROLS FORSECURITY, COMPLIANCE & IT OPERATIONSTripwire® State Analyzer automates change alerts. It works in tandem withTripwire Enterprise and Tripwire IP360™ to provide smart alerting andautomation in critical security areas that are not manageable by traditional
system state monitoring approaches.
Originally developed for customers with high security requirementsin the electric generation and transmission utilities industry, its highadoption rate now spans multiple industries that face similar monitoringchallenges.
Tripwire State Analyzer is scalable, flexible, and easy to maintain. This
document highlights available reports.

Users and Passwords
In the solution for local users, multiple aspects of user accounts are reported on.
The solution has built-in options which allow for:

» Addition of custom fields» Option of readable output, or CSV output» Alerting on password over allowed age limit» Alerting on passwords nearing allowed age limit

Evidence Reporting

Report by asset

Reporting includes
Justification andpassword age analysis

Example user accountnot allowlisted

Security AlertingAn account found thatneeds to be allowlisted
or removed from thesystem

Systems with new unauthorized users or stale passwords have change indicatorsfrom green to red. This example shows a detailed report of just the exceptions that a
System Administrator should attend to.

Support and Requirements
This solution is supported on:» Windows» RHELPortsReports are generated to support two use cases: evidence reporting and alerting fordaily maintenance of compliance. Report generation is automated once the solution
is fully implemented, and allows for scanning as often as is desired.

Evidence ReportingReport by Asset

Justification foreach allowed port

Ports lacking justification
called out

The solution has built-in options which allow for:» Ephemeral ports» Port ranges» TCP and UDP» Digest data from nmap or IP360» Matching ports to process» Addition of custom fields to reports

Support and Requirements
This solution is supported on:» Agent-based, internal scanning:- Windows- RHEL
- AIX- Solaris» Agentless, external scanning for an IP device

Compliance Alerting

Immediate indication if an
unexpected port is detected

Drill-down on an asset
to show details ofunexpected ports

Return to a compliant
state by closing or
justifying the port

Services
Once the user has supplied information about normal or expected services on asystem or class of systems, Tripwire will alert on new, unexpected ports. Report
generation is automated once the solution is fully implemented, and allows forreporting as often as is desired.

Evidence Reporting
Report by asset

Justification for eachallowed service

The solution has built-in options which allow for:» Specifying justification by individual servers or by server role
» Custom fields

Support and Requirements
This solution is supported on:» Windows» RHEL
» AIX» Solaris

Compliance Alerting

Drill-down on an asset
to show details ofunexpected services

Return to a compliant
state by stopping orjustifying the service

PLATFORM COVERAGE AND REQUIREMENTS
All solution areas listed in the chart below are based on Tripwire Enterprise. Allserver platforms require Tripwire Enterprise v8.0 or later and a Tripwire Enterprise
agent installed on the server.

SOLUTION AREA
PLATFORMPORTSERVICES

USERS

USERS & PASSWORDSGROUPSSOFTWARE

SHARESROUTESWindowsX

X

X

X

X

X

X

X

RHEL2

X

X

XX

AIX 5.33

X

X

X

X

AIX 6.13

X

X

X

X

Solaris 103, 4X

X

X

X

NMAP Scans5X

1

Additional platforms can be supported through a custom engagement with Tripwire Professional Services.

1 Windows XP, 7, 8, 2000, 2003,
2008, 2008 R2 & 2012
2 Requires WGET or CURL
3 Requires LSOF and WGET
4 Global Zone only
5 Requires NMAP capable host withTE Agent to act as initiator

X

XTripwire is the trusted leader for establishing a strong cybersecurity foundation. We protect the world’s
leading organizations against the most damaging cyberattacks, keeping pace with rapidly changing techcomplexities to defend against ever-evolving threats for more than 20 years. On-site and in the cloud, ourdiverse portfolio of solutions find, monitor and mitigate risks to organizations’ digital infrastructure—all
without disrupting day-to-day operations or productivity. Think of us as the invisible line that keeps
systems safe. Learn more at tripwire.com
The State of Security: News, trends and insights at tripwire.com/blog
Connect with us on LinkedIn, Twitter and Facebook©2021 Tripwire, Inc. Tripwire, Log Center/LogCenter, IP360, Tripwire Axon and others are trademarks or registered trademarks of Tripwire, Inc. All other product and company
names are property of their respective owners. All rights reserved.
TSARC1a2106