Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - ADAPTIVE LOG EXPORTER... Manual de usuario

Juniper Networks, Inc.

1194 North Mathilda Avenue

Sunnyvale, CA 94089

USA

408-745-2000

www.juniper.net

Part Number: 530-023497-01, Revision 1

Security Threat Response Manager

STRM Adaptive Log Exporter

Release 2008.2

2

Networks Inc. in the United States and other countries. All other trademarks, service marks, registered trademarks, or registered service marks in this

document are the property of Juniper Networks or their respective owners. All specifications are subject to change without notice. Juniper Networks

assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves

the right to change, modify, transfer, or otherwise revise this publication without notice.

FCC Statement

The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A

digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the

equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and

used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential

area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following

information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it

is not installed in accordance with NetScreen’s installation instructions, it may cause interferencewith radio and television reception. This equipment has

been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These

specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that

interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be

determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:

Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/TV

technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.

Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.

Disclaimer

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET

THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE

SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.

STRM Adaptive Log Exporter

Release 2008.2

Revision History

18 April 2008—Revision 1

The information in this document is current as of the date listed in the revision history.

1

About This Guide 3

Conventions 3

Technical Documentation 3

Documentation Feedback 3

Requesting Support 4

Overview 5

Integrating Device Support Modules (DSMs) with STRM 5

Using the Adaptive Log Exporter 6

Using the Menu 6

Using the Toolbar 6

Deploying Changes 7

Installing the Adaptive Log Exporter 9

Before You Begin 9

Installing the Adaptive Log Exporter 9

Un-installing the Adaptive Log Exporter 13

Setting Up the Adaptive Log Exporter 15

Using the Preferences Window 15

Managing Updates 16

Configuring Adaptive Log Exporter Updates 16

Scheduling Automatic Updates 19

Configuring the Update Site 21

Configuring Updates for Off-line Sites 22

Managing Devices 25

Installing Device Types 25

Updating Devices 27

Configuring Devices 29

Adding a Device 29

Editing a Device 31

Deleting a Device 32

Managing Destinations 35

Configuring Destinations 35

Adding a Destination 35

Editing a Destination 37

Deleting a Destination 39

Mapping to a Destination 40

Creating a Mapping 40

Removing a Mapping 41

Configuring the Cisco ACS Device 43

2

Configuring the Cisco CSA Device 45

Configuring the File Forwarder Device 47

Configuring the Juniper SBR Device 49

Configuring the Windows Event Log Device 51

Configuring the Microsoft DHCP Device 53

Configuring the Trend Micro InterScan VirusWall Device 55

Configuring the Microsoft Exchange Server Device 57

Forwarding OWA Logs 57

Forwarding SMTP Logs 58

Configuring the Microsoft SQL Server Device 59

Configuring the Microsoft IIS Device 61

Collecting Windows Event Logs 63

Collecting Logs Without an Agent 64

Configuring the Adaptive Log Exporter 65

Collecting Logs With an Agent 67

Configuring the Adaptive Log Exporter 68

Configuring STRM To Accept Logs 71

STRM Adaptive Log Exporter

ABOUT THIS GUIDE

The STRM Adaptive Log Exporter Users Guide provides you with information for

integrating Device Support Modules (DSMs) with STRM or STRM Log-Only using

the Adaptive Log Exporter.

Conventions Table 1 lists conventions that are used throughout this guide.

Technical

Documentation You can access technical documentation, technical notes, and release notes

directly from the Juniper networks Support Web site at

http://www.juniper.net/support/.

•

Documentation

Feedback We encourage you to provide feedback, comments, and suggestions so that we

can improve the documentation. Send your comments to

techpubs-comments@juniper.net, or fill out the documentation feedback form at

http://www.juniper.net/techpubs/docbug/docbugreport.html. If you are using e-mail, be

sure to include the following information with your comments:

•Document name

•Document part number

•Page number

•Software release version

Table 1 Icons

Icon Type Description

Information note Information that describes important features or

instructions.

Caution Information that alerts you to potential loss of

data or potential damage to an application,

system, device, or network.

Warning Information that alerts you to potential personal

injury.

STRM Adaptive Log Exporter

4ABOUT THIS GUIDE

Requesting

Support • Open a support case using the Case Management link at

http://www.juniper.net/support/ or call 1-888-314-JTAC (from the United States,

Canada, or Mexico) or 1-408-745-9500 (from elsewhere).

STRM Adaptive Log Exporter

1OVERVIEW

The Adaptive Log Exporter is a stand-alone application that allows you to integrate

devices/applications with STRM or STRM Log-Only. This chapter includes:

•Integrating Device Support Modules (DSMs) with STRM

•Using the Adaptive Log Exporter

•Deploying Changes

Note: Unless otherwise noted, all references to STRM refer to both STRM and

STRM Log-Only.

Integrating Device

Support Modules

(DSMs) with STRM

STRM can log and correlate events received from external sources such as

security equipment and network equipment. The Adaptive Log Exporter enables

you to forward data from Windows-based devices and applications to STRM for

processing. Using the Adaptive Log Exporter, you can easily integrate

Windows-based devices with STRM.

To integrate device/applications with STRM:

Step 1 Install available device types.

For more information, see Chapter 4 Managing Devices, Installing Device Types.

Step 2 Add and configure the required devices.

For more information, see Chapter 4 Managing Devices, Configuring Devices.

Step 3 Add and configure the required device destinations.

For more information, see Chapter 5 Managing Destinations, Configuring

Destinations.

Step 4 Map the device to the desired destination, such as syslog or a log file.

For more information, see Chapter 5 Managing Destinations, Mapping to a

Destination.

Step 5 Deploy all changes.

STRM Adaptive Log Exporter

6OVERVIEW

Using the Adaptive

Log Exporter The Adaptive Log Exporter provides menu and tool bar options. This section

provides information on the available options including:

•Using the Menu

•Using the Toolbar

Using the Menu The menu options include:

Using the Toolbar The toolbar options include:

Table 1-1 Adaptive Log Exporter Menu Options

Menu Sub-Menu Description

File Save Allows you to save current changes.

Save All Allows you to save all changes made during the

current session.

Deploy Allows you to deploy all changes made during

the current session.

Preferences Allows you to configure Adaptive Log Exporter

preferences. For more information, see.

Chapter 3 Setting Up the Adaptive Log

Exporter.

Exit Allows you to exit the application.

Edit Edit Device Allows you to edit the settings for a currently

saved device. For more information, see

Chapter 4 Managing Devices.

Edit Destination Allows you to edit the mapping destination for a

device. For more information, see Chapter 4

Managing Devices.

Window Show Views Allows you to view the Destination or Devices

tabs.

Help Software

Updates Allows you to check for software updates. For

more information, see Chapter 4 Managing

Devices.

About Allows you to access information about the

version of Adaptive Log Exporter you are using.

Table 1-2 Toolbar Options

Icon Description

Allows you to save current changes.

Allows you to save all changes made during the current session.

STRM Adaptive Log Exporter

Deploying Changes 7

Deploying Changes Once you configure your devices using the Adaptive Log Exporter, you must save

your changes to the staging area using the Save or Save All option. Then, you

must either manually deploy all changes using the Deploy menu option or, upon

exit, a window appears prompting you to deploy changes before you exit. All

deployed changes are then enforced.

Allows you to edit the settings for a currently saved device.

Allows you to edit the mapping destination for a device.

Allows you to deploy all changes made during the current session.

Allows you to install all available devices.

Table 1-2 Toolbar Options (continued)

Icon Description

Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Software de Juniper

Juniper

Juniper SPACE SECURITY DESIGN Manual de usuario

Juniper

Juniper NETWORK AND SECURITY MANAGER - NSM CONFIGURATION GUIDE FOR EX SERIES DEVICES REV... Manual de usuario

Juniper

Juniper JUNOSE 11.1.X MULTICAST ROUTING Manual de usuario

Juniper

Juniper PHYSICAL LAYER - CONFIGURATION GUIDE V11.1.X Manual de usuario

Juniper

Juniper IDP OS 5.1R1 - S REV 1 Manual de instrucciones

Juniper

Juniper STRM 2008.2R2 - UPGRADING TO STRM 2008.2R2 REV... Manual de instalación y operación

Juniper

Juniper JUNOS OS 10.3 - XML MANAGEMENT PROTOCOL GUIDE... Manual de instalación

Juniper

Juniper NETWORK AND SECURITY MANAGER 2010.3 - CONFIGURING INTRUSION DETECTION AND PREVENTION GUIDE... Manual de usuario

Juniper

Juniper JUNOS SPACE SDK Guía de instalación

Juniper

Juniper STRM 2008-2 - TECHNICAL NOTE CHANGING NETWORK SETTING... Guía

Juniper

Juniper JUNOS OS 10.4 RELEASE NOTES Manual de instrucciones

Juniper

Juniper JUNOSE 11.0.X PHYSICAL LAYER Manual de usuario

Juniper

Juniper JUNOSE 11.2.X IP SERVICES Manual de usuario

Juniper

Juniper JUNOSE SOFTWARE 11.0.1 - S 7-14-2010 Manual de instrucciones

Juniper

Juniper JUNOS PUS MOBILE SECURITY SUITE Manual de usuario

Juniper

Juniper JUNOS SPACE SERVICE NOW Manual de usuario

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - MANAGING VULNERABILITY ASSESSMENT... Manual de usuario

Juniper

Juniper VXA2000 START REV1 Manual de usuario

Juniper

Juniper JUNOSE 11.0.X IP SERVICES Manual de usuario

Juniper

Juniper STRM 2008-2 - TECHNICAL NOTE CHANGING NETWORK SETTING... Manual de instrucciones

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV... Manual de usuario

Juniper

Juniper NETWORK AND SECURITY MANAGER NSMXPRESS SERIES II - ... Manual de usuario

Juniper

Juniper ADVANCED INSIGHT SCRIPTS 2.5 - S REV 1 Manual de instrucciones

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV... Manual de instrucciones

Manuales populares de Software de otras marcas

COMPRO

COMPRO COMPROFM Manual de usuario

Muratec

Muratec OFFICEBRIDGE ONLINE Manual de usuario

Oracle

Oracle Contact Center Anywhere 8.1 Manual de usuario

Adobe

Adobe 65007312 - Photoshop Lightroom Manual

Avaya

Avaya NULL One-X for RIM Blackberry Manual de usuario

HP ProLiant BL420c Manual de usuario

PS Audio

PS Audio PowerPlay Manual del propietario

Brady

Brady LOCKOUT PRO 3.0 Manual de servicio

Avaya

Avaya Interaction Center Manual de usuario

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manual

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manual de usuario

Oracle

Oracle Application 9i Manual de usuario

Acer

Acer RDM Manual de usuario

Canon

Canon Vixia HF21 Manual de usuario

Canon

Canon ZR950 Manual de usuario

Samsung

Samsung Auto Backup Manual de usuario

Polycom

Polycom Vortex EF2201 Instrucciones de instalación y funcionamiento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manual de usuario