Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - AQL EVENT AND FLOW QUERY CLI... User manual

Juniper Networks, Inc.

1194 North Mathilda Avenue

Sunnyvale, CA 94089

USA

408-745-2000

www.juniper.net

Part Number: 530-xxxxxx-01, Beta Draft

Security Threat Response Manager

AQL Event and Flow Query CLI Guide

Release 2008.2

2

Networks Inc. in the United States and other countries. All other trademarks, service marks, registered trademarks, or registered service marks in this

document are the property of Juniper Networks or their respective owners. All specifications are subject to change without notice. Juniper Networks

assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves

the right to change, modify, transfer, or otherwise revise this publication without notice.

FCC Statement

The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A

digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the

equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and

used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential

area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following

information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it

is not installed in accordance with NetScreen’s installation instructions, it may cause interferencewith radio and television reception. This equipment has

been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These

specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that

interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be

determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:

Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/TV

technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.

Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.

Disclaimer

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET

THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE

SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.

AQL Event and Flow Query CLI Guide

Release 2008.2

Revision History

18 April 2008—Beta Draft

The information in this document is current as of the date listed in the revision history.

CONTENTS

ABOUT THIS GUIDE

Conventions 3

Technical Documentation 3

Documentation Feedback 3

Requesting Support 4

1USING THE AQL QUERY CLI

About the AQL Query CLI 5

Accessing the AQL Query CLI 6

Using a Select Statement 7

Using Where Clauses 10

Using the Group By Clause 10

Using the Order By Clause 11

Using the Count(*) Clause 12

Using the Distinct Clause 12

Using the Count (Distinct ...) Clause 12

Using the Materialize View Clause 13

Using the Like Clause 13

Using the Describe Statement 14

AQL Event and Flow Query CLI Guide

ABOUT THIS GUIDE

The AQL Event and Flow Query CLI Guide provides you with information for using

the AQL CLI. This guide assumes you have advanced knowledge of Linux

command line functionality.

Conventions Table 1 lists conventions that are used throughout this guide.

Technical

Documentation You can access technical documentation, technical notes, and release notes

directly from the Juniper networks Support Web site at

http://www.juniper.net/support/.

Documentation

Feedback We encourage you to provide feedback, comments, and suggestions so that we

can improve the documentation. Send your comments to

techpubs-comments@juniper.net, or fill out the documentation feedback form at

http://www.juniper.net/techpubs/docbug/docbugreport.html. If you are using e-mail, be

sure to include the following information with your comments:

•Document name

•Document part number

•Page number

•Software release version

Table 1 Icons

Icon Type Description

Information note Information that describes important features or

instructions.

Caution Information that alerts you to potential loss of

data or potential damage to an application,

system, device, or network.

Warning Information that alerts you to potential personal

injury.

AQL Event and Flow Query CLI Guide

4ABOUT THIS GUIDE

Requesting

Support • Open a support case using the Case Management link at

http://www.juniper.net/support/ or call 1-888-314-JTAC (from the United States,

Canada, or Mexico) or 1-408-745-9500 (from elsewhere).

AQL Event and Flow Query CLI Guide

1USING THE AQL QUERY CLI

You can use the AQL Event and Flow Query Command Line Interface (CLI) to

access flows and events stored in the Ariel database. This document provides

information on accessing and using the AQL query CLI including:

•About the AQL Query CLI

•Accessing the AQL Query CLI

•Using a Select Statement

•Using Where Clauses

•Using the Group By Clause

•Using the Order By Clause

•Using the Count(*) Clause

•Using the Distinct Clause

•Using the Count (Distinct ...) Clause

•Using the Materialize View Clause

•Using the Like Clause

•Using the Describe Statement

About the AQL

Query CLI The AQL event and flow query CLI allows you to access raw flows and events

stored in the Aerial database. The AQL query CLI includes syntax that is a subset

of the SQL92 standard and provides support for two tables: events and flows.

Note: The AQL CLI does not provide support for joining tables.

The AQL Event and Flow Query CLI functions in the following modes:

•Interactive mode - Using a simple shell, you can enter queries interactively

and view the results in a standard output. At the query prompt, any valid AQL

statement is accepted. If time is not specified (using -start and -end

options), the last minute is assumed as the time range. You can also access

previous commands by using your up arrow. This is the default mode.

•Non-interactive mode - You can enter the non-interactive mode by adding the

-execute <AQL query> parameter to the command. The -execute

command must be followed by a valid AQL query surrounded by double quotes.

AQL Event and Flow Query CLI Guide

6USING THE AQL QUERY CLI

The non-interactive mode does not include a prompt allowing you to redirect the

output to a file with a regular UNIX pipe syntax. By default, the results are sent

to a standard output.

Accessing the AQL

Query CLI To access the AQL query CLI:

Step 1 Log in to STRM, as root.

Step 2 Enter the following command:

/opt/qradar/bin/arielClient

The Query prompt appears.

CLI Options Table 1-1 lists the supported CLI options:

Table 1-1 AQL CLI Options

Option Description

-range <first

record> <last

record>

Limits the number of records sent to the output within the

specified range. This is useful for viewing a selection of

records generated by an ordered query. For example, if you

wish to view the first ten records, you must specify -range 1

10.

-debug Generates debugging output during execution.

-start <time>,

-end <time> Specifies the start and end time of the query.

Where <time> specifies the time. You must specify the time

as either a UNIX timestamp or a date using the following

format: yyyy/mm/dd-hh:mm:ss.

For example:

/opt/qradar/bin/arielClient - start

2007/08/11-01:15:00 -end 2007/08/11-01:17:00

-exectime <time

limit> Specifies the maximum period of time, in seconds, a single

query may continue processing.

-execute <AQL

query> Allows you to enter non-interactive mode that allows you to

process a query that is sent to standard output. If you do not

include this option, the command is entered in interactive

mode. You must include your query in double quotes.

-f <output

format> Allows you to specify the output format for the query results.

The table format is an ASCII drawing of a multi-column table

while the CSV format provides a comma separated list.

Where <output format> indicates the output format. The

options are table or csv.

-remote

<host:port> Specifies that you wish to connect to a specific Ariel query

host and port.

AQL Event and Flow Query CLI Guide

Using a Select Statement 7

For example:

If you wish to enter a command in interactive mode:

/opt/qradar/bin/arielClient -start 2007/08/11-01:15:00 -end

2007/08/11-01:17:00 -exectime 60

/opt/qradar/bin/arielClient

/opt/qradar/bin/arielClient -start 2007/08/11-01:15:00 -end

2007/08/11-01:17:00 -f csv

If you wish to enter a command in non-interactive mode:

/opt/qradar/bin/arielClient -start 2007/08/11-01:15:00 -end

2007/08/11-01:17:00 -exectime 60 -execute "select * from flows

where sourceIP = '231.12.37.17' and protocol != 'TCP.tcp_ip'"

Using a Select

Statement You can use a select statement that includes one or more fields of a flow or event.

You can also use an asterisk (*) to denote all columns. All field names are case

sensitive, however, the terms select and from are not case sensitive. The

supported fields include:

Table 1-2 Supported Fields

Table Supported Statement

Flow application

applicationId

destinationASN

destinationBytes

destinationByteRatio

destinationDSCP

destinationFlags

destinationIP

destinationIfIndex

destinationNetwork

destinationPackets

destinationPacketRatio

destinationPayload

destinationPort

destinationPrecedence

destinationTOS

firstPacketTime

flowDirection

flowSource

flowType

AQL Event and Flow Query CLI Guide

8USING THE AQL QUERY CLI

geographic

icmpType

interface

intervalId

lastPacketTime

packetsOut

protocol

remoteNet

remoteServices

sourceASN

sourceBytes

sourceByteRatio

sourceDSCP

sourceFlags

sourceIP

sourceIfIndex

sourceNetwork

sourcePackets

sourcePacketRatio

sourcePort

sourcePrecedence

sourcePayload

sourceTOS

totalBytes

Events category

credibility

creEventList

destinationIP

destinationMAC

destinationNetwork

destinationPort

device

deviceGroup

deviceType

duration

endTime

Table 1-2 Supported Fields (continued)

Table Supported Statement

This manual suits for next models

Table of contents

Other Juniper Software manuals

Juniper

Juniper JUNOSE 11.1.X - QUALITY OF SERVICE CONFIGURATION GUIDE... User manual

Juniper

Juniper JUNOS OS 10.4 - PROTECTED SYSTEM DOMAIN User manual

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - IP-IPV6-IGP CONFIGURATION GUIDE... User manual

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - MANAGING VULNERABILITY ASSESSMENT... User manual

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 -... User manual

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - BGP AND MPLS CONFIGURATION GUIDE... User manual

Juniper

Juniper IDP OS 5.1R1 - S REV 1 Instruction Manual

Juniper

Juniper JUNOSE SOFTWARE 11.0.X - LINK LAYER CONFIGURATION GUIDE... User manual

Juniper

Juniper IGP - CONFIGURATION GUIDE V11.1.X User manual

Juniper

Juniper NETWORK AND SECURITY MANAGER - S REV 3 Instruction Manual

Juniper

Juniper JUNOS 10.1 - S 5-13-2010 Instruction Manual

Juniper

Juniper JUNOS OS 10.4 - S REV 5 Instruction Manual

Juniper

Juniper NETWORK AND SECURITY MANAGER 2010.4 - CONFIGURING J SERIES SERVICES ROUTERS AND SRX SERIES SERVICES GATEWAYS GUIDE... User manual

Juniper

Juniper JUNOSE 11.0.X PHYSICAL LAYER User manual

Juniper

Juniper JUNOS SPACE SERVICE INSIGHT Installation guide

Juniper

Juniper NETWORK AND SECURITY MANAGER 2010.4 - CONFIGURING INTRUSION DETECTION PREVENTION DEVICES GUIDE REV... User manual

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV... User manual

Juniper

Juniper NETWORK AND SECURITY MANAGER 2010.3 - M-SERIES AND MX-SERIES DEVICES GUIDE... User manual

Juniper

Juniper JUNOSE 11.1.X - COMMAND REFERENCE N TO Z... Installation manual

Juniper

Juniper JUNOS OS 10.3 - SYSTEM LOG MESSAGES REFERENCE... User manual

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - POLICY MANAGEMENT CONFIGURATION GUIDE... User manual

Juniper

Juniper JUNOSE SOFTWARE 11.0.X - LINK LAYER CONFIGURATION GUIDE... User manual

Juniper

Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE... Instruction Manual

Juniper

Juniper BGP - CONFIGURATION GUIDE V 11.1.X User manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Novell

Novell GROUPWISE 8 - INTERNET AGENT manual

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual