TASL and Plugins

Excluding TASL Files

TASLs may be disabled selectively by adding the TASL script file name (e.g., program_accounting.tasl) to the Disabled TASL Scripts section. This option is located under the TASL and Plugins portion of the Advanced section of the Tenable Log Correlation Engine interface. This is useful for cases where a particular TASL script is not needed by an organization or where the TASL might be causing performance issues and needs to be disabled either temporarily or permanently.

Any disabled TASLs, if removed from the Disabled TASL Scripts section, can be re-enabled.

Excluding PRM Files

In some cases, a user may wish to allow the global updates of PRM files, but specifically exclude some from being run. This can be facilitated by using the Disabled PRM Scripts section of the Tenable Log Correlation Engine interface. The PRM files to be processed but not loaded can be specified in this location, one per line.

If there is a need to customize a plugin or plugins, rename the original file before making modifications. Once done, include the name of the original plugin in the Disabled PRM Scripts section. If an existing PRM file is modified and not renamed, it will be overwritten on the next PRM update. If the original is not disabled, and the Multiple Matches option is not enabled, only one of the two PRM files will match. This option is located under the TASL and Plugins portion of the Advanced section of the Tenable Log Correlation Engine interface.