Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT ADMINISTRATION GUIDE REV... Manuel utilisateur

Juniper Networks, Inc.

1194 North Mathilda Avenue

Sunnyvale, CA 94089

USA

408-745-2000

www.juniper.net

Part Number: 530-027300-01, Revision 1

Security Threat Response Manager

STRM Log Management Users Guide

Release 2008.2 R2

2

Networks Inc. in the United States and other countries. All other trademarks, service marks, registered trademarks, or registered service marks in this

document are the property of Juniper Networks or their respective owners. All specifications are subject to change without notice. Juniper Networks

assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves

the right to change, modify, transfer, or otherwise revise this publication without notice.

FCC Statement

The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A

digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the

equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and

used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential

area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following

information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it

is not installed in accordance with NetScreen’s installation instructions, it may cause interference with radio and television reception. This equipment has

been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These

specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that

interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be

determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:

Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/TV

technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.

Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.

Disclaimer

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET

THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE

SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.

STRM Log Management Users Guide

Release 2008.2 R2

Revision History

September 2008—Revision 1

The information in this document is current as of the date listed in the revision history.

CONTENTS

ABOUT THIS GUIDE

Conventions 1

Technical Documentation 1

Contacting Customer Support 1

1ABOUT STRM LOG MANAGEMENT SLIM

Logging In to STRM Log Management 3

Dashboard 4

Event Viewer 5

Reports 5

Using STRM Log Management 6

Sorting Results 6

Refreshing the Interface 6

Pausing the Interface 6

Investigating IP Addresses 6

STRM Log Management Time 7

Accessing On-line Help 7

STRM Log Management Administration Console 8

2USING THE DASHBOARD

About the Dashboard 9

Using the Dashboard 10

Event Viewer 10

Events Over Time 10

Events By Severity 11

Top Devices 11

Reports 12

System Summary 12

Adding Items 13

3USING THE EVENT VIEWER

Using the Event Viewer Interface 16

Using the Toolbar 16

Using the Right-Click Menu Options 16

Viewing Events 17

Viewing Normalized Events 17

Viewing Raw Events 20

Viewing Aggregate Normalized Events 21

Using the Search 27

Searching Events 27

Deleting Saved Searches 30

Modifying Event Mapping 31

Exporting Events 33

4CONFIGURING RULES

Viewing Rules 36

Enabling/Disabling Rules 37

Creating a Rule 37

Event Rule Tests 47

Copying a Rule 52

Deleting a Rule 53

Grouping Rules 53

Viewing Groups 53

Creating a Group 54

Editing a Group 55

Copying an Item to Another Group(s) 56

Deleting an Item from a Group 57

Assigning an Item to a Group 58

Editing Building Blocks 58

5MANAGING REPORTS

Using the Reports Interface 62

Using the Navigation Menu 62

Using the Toolbar 63

Viewing Reports 63

Grouping Reports 64

Creating a Group 65

Editing a Group 66

Copying a Template to Another Group 66

Deleting a Template From a Group 67

Assigning a Report to a Group 68

Creating a Report 68

Creating a Template 69

Configuring Charts 76

Selecting a Graph Type 85

Using Default Report Templates 86

Generating a Report 87

Duplicating a Report 87

Sharing a Report 88

Branding Your Report 88

ADEFAULT RULES AND BUILDING BLOCKS

Default Rules 91

Default Building Blocks 101

AGLOSSARY

INDEX

STRM Log Management Users Guide

ABOUT THIS GUIDE

The STRM Log Management Users Guide provides information on managing

STRM Log Management including the Dashboard, Reports, and Event Viewer

interfaces.

Conventions Table 1 lists conventions that are used throughout this guide.

Technical

Documentation

You can access technical documentation, technical notes, and release notes

directly from the Juniper Networks support web site at https://juniper.net/support.

Once you access the Juniper Networks support web site, locate the product and

software release for which you require documentation.

Your comments are important to us. Please send your e-mail comments about this

guide or any of the Juniper Networks documentation to:

documentation@juniper.com.

Include the following information with your comments:

•Document title

•Page number

Table 1 Icons

Icon Type Description

Information note Information that describes important features or

instructions.

Caution Information that alerts you to potential loss of

data or potential damage to an application,

system, device, or network.

Warning Information that alerts you to potential personal

injury.

STRM Log Management Users Guide

2ABOUT THIS GUIDE

Contacting

Customer Support

To help you resolve any issues that you may encounter when installing or

maintaining STRM Log Management, you can contact Customer Support as

follows:

•Log a support request 24/7: https://juniper.net/support

For access to the Juniper Networks support web site, please contact Customer

Support.

•Access Juniper Networks support and Self-Service support using e-mail:

support@juniper.net

•Telephone assistance: 1-800-638-8296.

STRM Log Management Users Guide

1ABOUT STRM LOG MANAGEMENT

STRM Log Management is a network security management platform that provides

situational awareness and compliance support through security event correlation,

analysis, and reporting. This chapter provides an overview of the STRM Log

Management interface including:

•Logging In to STRM Log Management

•Dashboard

•Event Viewer

•Reports

•Using STRM Log Management

•STRM Log Management Administration Console

Note: When navigating STRM Log Management, do not use the browser Back

button. Use the navigation options available with STRM Log Management to

navigate the interface.

Logging In to STRM

Log Management

To login to STRM Log Management:

Step 1 Open your web browser.

Step 2 Log in to STRM Log Management:

https://<IP Address>

Where <IP Address>is the IP address of the STRM Log Management system.

The default values are:

Username: admin

Password: <root password>

Where <root password> is the password assigned to STRM Log Management

during the installation process. For more information, see the STRM Log

Management Installation Guide.

Step 3 Click Login To STRM Log Management.

For your STRM Log Management Console, a default license key provides you

access to the interface for 5 weeks. A window appears providing the date that the

STRM Log Management Users Guide

4ABOUT STRM LOG MANAGEMENT

temporary license key will expire. For information on installing a permanent license

key, see the STRM Log Management Administration Guide.

Dashboard The Dashboard tab is the default interface that appears when you log in to STRM

Log Management. The Dashboard tab provides summary and detailed information

on events occurring on your network. The Dashboard is customizable on a per

user basis to focus on individual user’s security or network operations

responsibilities.

Note: For more information on using the Dashboard, see Chapter 2 Using the

Dashboard.

Autres manuels pour SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT ADMINISTRATION GUIDE REV...

Table des matières

Autres manuels Juniper Logiciel

Juniper

Juniper PHYSICAL LAYER - CONFIGURATION GUIDE V11.1.X Manuel utilisateur

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - POLICY MANAGEMENT CONFIGURATION GUIDE... Manuel utilisateur

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - AQL EVENT AND FLOW QUERY CLI... Manuel utilisateur

Juniper

Juniper JUNOSE 11.1.X - SYSTEM EVENT LOGGING ... Manuel utilisateur

Juniper

Juniper MWS1000 Instructions d'installation

Juniper

Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE... Mode d’emploi

Juniper

Juniper IP SERVICES - CONFIGURATION GUIDE V 11.1.X Manuel utilisateur

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - BGP AND MPLS CONFIGURATION GUIDE... Manuel utilisateur

Juniper

Juniper JUNOSE 11.2.X MULTICAST ROUTING Manuel utilisateur

Juniper

Juniper NETWORK AND SECURITY MANAGER NSMXPRESS - ... Manuel utilisateur

Juniper

Juniper JUNOS 10.1 - CONFIGURATION GUIDE 1-2010 Manuel utilisateur

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - POLICY MANAGEMENT CONFIGURATION GUIDE... Manuel utilisateur

Juniper

Juniper JUNOSE 11.2.X IP SERVICES Manuel utilisateur

Juniper

Juniper JUNOS SPACE SDK Guide d'installation

Juniper

Juniper JUNOS OS 10.4 - S REV 5 Mode d’emploi

Juniper

Juniper JUNOS PUS MOBILE SECURITY SUITE Manuel utilisateur

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - COMMAND REFERENCE N TO Z... Manuel d'installation

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV... Manuel utilisateur

Juniper

Juniper NETWORK AND SECURITY MANAGER 2010.4 - API GUIDE REV... Manuel utilisateur

Juniper

Juniper JUNIPER CARE SERVICES Manuel utilisateur

Juniper

Juniper MEDIA FLOW CONTROLLER 2.0.4 - ADMINISTRATOR S GUIDE AND... Manuel de service

Juniper

Juniper JUNOS OS 10.4 - FOR EX REV 1 Manuel utilisateur

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - PHYSICAL LAYER CONFIGURATION GUIDE... Manuel utilisateur

Juniper

Juniper JUNOS OS 10.3 - SYSTEM LOG MESSAGES REFERENCE... Manuel utilisateur

Manuels Logiciel populaires d'autres marques

COMPRO

COMPRO COMPROFM Manuel utilisateur

Muratec

Muratec OFFICEBRIDGE ONLINE Manuel utilisateur

Oracle

Oracle Contact Center Anywhere 8.1 Manuel utilisateur

Adobe

Adobe 65007312 - Photoshop Lightroom Manuel

Avaya

Avaya NULL One-X for RIM Blackberry Manuel utilisateur

HP ProLiant BL420c Manuel utilisateur

PS Audio

PS Audio PowerPlay Manuel du propriétaire

Brady

Brady LOCKOUT PRO 3.0 Manuel de service

Avaya

Avaya Interaction Center Manuel utilisateur

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuel

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuel utilisateur

Oracle

Oracle Application 9i Manuel utilisateur

Acer

Acer RDM Manuel utilisateur

Canon

Canon Vixia HF21 Manuel utilisateur

Canon

Canon ZR950 Manuel utilisateur

Samsung

Samsung Auto Backup Manuel utilisateur

Polycom

Polycom Vortex EF2201 Instructions d'installation et d'utilisation

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuel utilisateur