Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 -... User manual

Juniper Networks, Inc.

1194 North Mathilda Avenue

Sunnyvale, CA 94089

USA

408-745-2000

www.juniper.net

Part Number: 530-027294-01, Revision 1

Security Threat Response Manager

STRM Users Guide

Release 2008.2 R2

2

Networks Inc. in the United States and other countries. All other trademarks, service marks, registered trademarks, or registered service marks in this

document are the property of Juniper Networks or their respective owners. All specifications are subject to change without notice. Juniper Networks

assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves

the right to change, modify, transfer, or otherwise revise this publication without notice.

FCC Statement

The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A

digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the

equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and

used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential

area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following

information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it

is not installed in accordance with NetScreen’s installation instructions, it may cause interference with radio and television reception. This equipment has

been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These

specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that

interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be

determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:

Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/TV

technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.

Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.

Disclaimer

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET

THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE

SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.

STRM Users Guide

Release 2008.2 R2

Revision History

September 2008—Revision 1

The information in this document is current as of the date listed in the revision history.

CONTENTS

ABOUT THIS GUIDE

Conventions 1

Technical Documentation 1

Contacting Customer Support 2

1ABOUT STRM

Logging In to STRM 3

Dashboard 4

Offense Manager 5

Event Viewer 5

Flow Viewer 6

Assets 6

Network Surveillance 8

Reports 9

Using STRM 9

Sorting Results 9

Refreshing the Interface 10

Pausing the Interface 10

Investigating IP Addresses 10

Viewing STRM Time 11

Accessing On-line Help 11

STRM Administration Console 11

2USING THE DASHBOARD

About the Dashboard 13

Using the Dashboard 15

Network Surveillance 16

Traffic 16

TopN 17

Offense Manager 18

Offenses 18

Attackers and Targets 19

Categories 19

Event Viewer 20

Events Over Time 20

Events By Severity 20

Top Devices 21

Reports 22

Enterprise Security State 22

Enterprise Vulnerability State 23

System Summary 24

Adding Items 24

3MANAGING YOUR NETWORK ACTIVITY

Using the Network Surveillance Menu 25

Global Views 25

Asset Map 26

Bookmarks 27

QRL Options 27

Viewing Network Activity 28

Interpreting the Graphs 28

Changing the View 30

Changing Flow Attributes 32

Changing Traffic Location 33

Investigating Traffic Using TopN 34

Viewing the TopN Information 34

Investigating Traffic 35

Investigating Flows 36

4MANAGING SENTRIES

About Sentries 40

Types of Sentries 40

Viewing Sentries 42

Creating a Sentry 43

Creating a Security/Policy Sentry 44

Creating a Behavior Sentry 49

Creating an Anomaly Sentry 56

Creating a Threshold Sentry 61

Creating a Custom Sentry 66

Editing a Sentry 72

5INVESTIGATING OFFENSES

Using the Offense Manager 78

Managing My Offenses 78

Managing Offenses 79

Viewing Offenses 79

Searching Offenses 88

Removing Offenses 90

Assigning Offenses to Users 92

Viewing Offense By Category 93

Managing Offenses By Attacker 97

Viewing Offenses by Attacker 97

Searching Attackers 104

Managing Offenses By Targets 106

Viewing Offenses By Targets 106

Searching Targets 112

Managing Offenses By Networks 114

Viewing Offenses By Networks 114

Searching Networks 124

Marking an Item For Follow-Up 125

Adding Notes 125

Configuring Notification 126

Managing Network Anomalies 127

Viewing Network Anomaly Offenses 127

Closing Offenses 129

Forwarding Network Anomaly Offenses 130

Exporting Offenses 131

6USING THE EVENT VIEWER

Using the Event Viewer Interface 134

Using the Toolbar 134

Using the Right-Click Menu Options 134

Viewing Events 135

Viewing Normalized Events 135

Viewing Raw Events 139

Viewing Aggregate Normalized Events 140

Searching Events 145

Deleting Saved Searches 148

Viewing the Associated Offense 148

Modifying Event Mapping 149

Tuning False Positives 151

Exporting Events 152

7USING THE FLOW VIEWER

Using the Flow Viewer Interface 154

Using the Toolbar 154

Using the Right-Click Menu Options 154

Viewing Flows 155

Viewing Aggregated Flows 158

Using the Search 164

Searching Flows 164

Deleting Saved Searches 167

Exporting Flows 167

8MANAGING ASSETS

Searching Asset Profiles 169

Adding an Asset Profile 175

Editing an Asset 176

Deleting Assets 178

Deleting an Asset 178

Deleting All Assets 178

Importing Asset Profiles 179

Exporting Assets 180

9MANAGING REPORTS

Using the Reports Interface 182

Using the Navigation Menu 182

Using the Toolbar 183

Viewing Reports 183

Grouping Reports 184

Creating a Group 185

Editing a Group 186

Copying a Template to Another Group 186

Deleting a Template From a Group 187

Assigning a Report to a Group 188

Creating a Report 188

Creating a Template 189

Configuring Charts 196

Selecting a Graph Type 214

Using Default Report Templates 216

Generating a Report 217

Duplicating a Report 217

Sharing a Report 218

Branding Your Report 218

10 USING TNC RECOMMENDATIONS

Configuring TNC Recommendations 221

Removing TNC Recommendations 223

AGLOSSARY

INDEX

STRM Users Guide

ABOUT THIS GUIDE

The STRM Users Guide provides information on managing STRM including the

Dashboard, Offense Manager, Reports, Event Viewer, and Network Surveillance

interfaces.

Conventions Table 1 lists conventions that are used throughout this guide.

Technical

Documentation

You can access technical documentation, technical notes, and release notes

directly from the Juniper Networks support web site at https://juniper.net/support.

Once you access the Juniper Networks support web site, locate the product and

software release for which you require documentation.

Your comments are important to us. Please send your e-mail comments about this

guide or any of the Juniper Networks documentation to:

documentation@juniper.net.

Include the following information with your comments:

•Document title

•Page number

Table 1 Icons

Icon Type Description

Information note Information that describes important features or

instructions.

Caution Information that alerts you to potential loss of

data or potential damage to an application,

system, device, or network.

Warning Information that alerts you to potential personal

injury.

STRM Users Guide

2ABOUT THIS GUIDE

Contacting

Customer Support

To help you resolve any issues that you may encounter when installing or

maintaining STRM, you can contact Customer Support as follows:

•Log a support request 24/7: https://juniper.net/support/

For access to the Juniper Networks support web site, please contact Customer

Support.

•Access Juniper Networks support and Self-Service support using e-mail:

[email protected]

•Telephone assistance: 1-800-638-8296.

STRM Users Guide

1ABOUT STRM

STRM is a network security management platform that provides situational

awareness and compliance support through the combination of flow-based

network knowledge, security event correlation, and asset-based vulnerability

assessment. This chapter provides an overview of the STRM interface including:

•Logging In to STRM

•Dashboard

•Offense Manager

•Event Viewer

•Flow Viewer

•Assets

•Network Surveillance

•Reports

•Using STRM

•STRM Administration Console

Note: When navigating STRM, do not use the browser Back button. Use the

navigation options available with STRM to navigate the interface.

Logging In to STRM To login to STRM:

Step 1 Open your web browser.

Step 2 Log in to STRM:

https://<IP Address>

Where <IP Address>is the IP address of the STRM system. The default values

are:

Username: admin

Password: <root password>

Where <root password> is the password assigned to STRM during the

installation process. For more information, see the STRM Installation Guide.

STRM Users Guide

4ABOUT STRM

Step 3 Click Login To STRM.

For your STRM Console, a default license key provides you access to the interface

for 5 weeks. A window appears providing the date that the temporary license key

will expire. For information on installing a permanent license key, see the STRM

Administration Guide.

Dashboard The Dashboard tab is the default interface that appears when you log in to STRM.

The Dashboard tab provides summary and detailed information on offenses

occurring on your network, your network overall security and vulnerability state, as

well as in depth views into your network traffic behavior. The Dashboard is

customizable on a per user basis to focus on individual user’s security or network

operations responsibilities.

Note: For more information on using the Dashboard, see Chapter 2 Using the

Dashboard.

This manual suits for next models

Table of contents

Other Juniper Software manuals

Juniper

Juniper STRM 2008-2 - TECHNICAL NOTE CHANGING NETWORK SETTING... Instruction Manual

Juniper

Juniper SPACE SECURITY DESIGN User manual

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV... User manual

Juniper

Juniper STRM 2008.2R2 - UPGRADING TO STRM 2008.2R2 REV... Installation and operation manual

Juniper

Juniper JUNOSE 11.0.X MULTICAST ROUTING User manual

Juniper

Juniper JUNOSE SOFTWARE 11.0.X - COMMAND REFERENCE A TO M... Installation manual

Juniper

Juniper STRM 2008-2 - TECHNICAL NOTE CHANGING NETWORK SETTING... Assembly instructions

Juniper

Juniper RESIDENT CONSULTANT User manual

Juniper

Juniper JUNOS PULSE 2.0 RELEASE NOTES Instruction Manual

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - POLICY MANAGEMENT CONFIGURATION GUIDE... User manual

Juniper

Juniper NETWORK AND SECURITY MANAGER 2010.4 - REV1 User manual

Juniper

Juniper MEDIA FLOW CONTROLLER 2.0.5 - S REV... Instruction Manual

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT ADMINISTRATION GUIDE REV... User manual

Juniper

Juniper NETWORK AND SECURITY MANAGER NSMXPRESS SERIES II - ... User manual

Juniper

Juniper NETWORK AND SECURITY MANAGER 2010.3 - CONFIGURING INTRUSION DETECTION AND PREVENTION GUIDE... User manual

Juniper

Juniper NETWORK AND SECURITY MANAGER NSMXPRESS - ... User manual

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - MANAGING VULNERABILITY ASSESSMENT... User manual

Juniper

Juniper IDP OS 5.1R1 - S REV 1 Instruction Manual

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - AQL EVENT AND FLOW QUERY CLI... User manual

Juniper

Juniper SPACE VIRTUAL CONTROL User manual

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - COMMAND REFERENCE N TO Z... Installation manual

Juniper

Juniper JUNOS OS 10.4 - FOR EX REV 1 User manual

Juniper

Juniper NETWORK AND SECURITY MANAGER - NSM CONFIGURATION GUIDE FOR EX SERIES DEVICES REV... User manual

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - S... Instruction Manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Novell

Novell GROUPWISE 8 - INTERNET AGENT manual

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual