Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV... Manual de usuario

Juniper Networks, Inc.

1194 North Mathilda Avenue

Sunnyvale, CA 94089

USA

408-745-2000

www.juniper.net

Part Number: 530-025608-01, Revision 1

Security Threat Response Manager

Configuring DSMs

Release 2008.2

2

Networks Inc. in the United States and other countries. All other trademarks, service marks, registered trademarks, or registered service marks in this

document are the property of Juniper Networks or their respective owners. All specifications are subject to change without notice. Juniper Networks

assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves

the right to change, modify, transfer, or otherwise revise this publication without notice.

FCC Statement

The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A

digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the

equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and

used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential

area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following

information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it

is not installed in accordance with NetScreen’s installation instructions, it may cause interferencewith radio and television reception. This equipment has

been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These

specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that

interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be

determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:

Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/TV

technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.

Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.

Disclaimer

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET

THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE

SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.

Configuring DSMs

Release 2008.2

Revision History

June 2008—Revision 1

The information in this document is current as of the date listed in the revision history.

1

About This Guide 1

Overview 3

3Com 8800 Series Switch 5

Ambiron TrustWave ipAngel 7

Apache HTTP Server 9

Apple Mac OS X 11

Array Network SSL VPN 13

F5 Networks BigIP 15

Blue Coat SG 17

Check Point FireWall-1 19

Check Point Provider-1 25

Cisco ACS 29

Cisco ASA 31

Cisco CatOS for Catalyst Switches 33

Cisco CSA 35

Cisco FWSM 37

Cisco IDS/IPS 39

Cisco NAC Device 41

Cisco IOS 43

Cisco Pix 45

Cisco VPN 3000 Concentrator 47

CyberGuard Firewall/VPN Appliance 49

2

Enterasys Dragon 51

Enterasys Matrix Router 55

Enterasys Matrix N-Series 57

Extreme Networks ExtremeWare 59

ForeScout CounterACT 61

Fortinet FortiGate 63

Generic Authorization Server 65

Generic Firewall 69

IBM AIX 5L 73

IBM Proventia Management SiteProtector 75

ISS Proventia 77

Juniper DX Application Acceleration Platform 79

Juniper EX-Series Ethernet Switch 81

Juniper NetScreen IDP 83

Juniper Networks Secure Access 85

Juniper Infranet Controller 89

Juniper NetScreen Firewall 91

Juniper NSM 93

Juniper Router 95

Juniper Steel-Belted RADUIS 97

Linux DHCP 99

101

Linux IPtables 101

103

Linux Login Messages 103

3

105

McAfee Intrushield 105

107

McAfee ePolicy Orchestrator 107

109

MetaInfo MetaIP 109

111

Microsoft Exchange Server 111

113

Microsoft DHCP Server 113

115

Microsoft IAS Server 115

117

Microsoft IIS 117

119

Microsoft SQL Server 119

121

Microsoft Windows Security Event Log 121

123

Niksun 123

125

Nokia Firewall 125

129

Nortel ARN 129

131

Nortel Application Switch 131

133

Nortel Contivity 5000 133

135

Nortel Contivity Firewall/VPN 135

137

Nortel Switched Firewall 5100 137

141

Nortel Switched Firewall 6000 141

145

Nortel VPN Gateway 145

147

OpenBSD 147

149

Open Source SNORT 149

151

Oracle Audit Records 151

155

Oracle DB Listener 155

159

4

ProFTPd 159

161

Samhain 161

165

Secure Computing Sidewinder 165

167

Sun Solaris 167

169

Sun Solaris DHCP 169

171

SonicWALL 171

173

Sun Solaris Sendmail 173

175

Sourcefire Intrusion Sensor 175

177

Squid Web Proxy 177

179

Symantec SGS 179

181

Symantec System Center 181

183

Symark PowerBroker 183

185

Tipping Point Intrusion Prevention System 185

187

TippingPoint X505/X506 Device 187

189

TopLayer 189

191

Trend Micro InterScan VirusWall 191

193

Tripwire 193

195

Universal DSM 195

207

Vericept Content 360 DSM 207

209

Supported DSMs 209

Configuring DSMs

ABOUT THIS GUIDE

The Configuring DSMs Guide provides you with information for configuring sensor

devices (DSMs) and integrating the DSMs with STRM or STRM Log Management.

Conventions Table 1 lists conventions that are used throughout this guide.

Technical

Documentation You can access technical documentation, technical notes, and release notes

directly from the Juniper networks Support Web site at

http://www.juniper.net/support/.

Documentation

Feedback We encourage you to provide feedback, comments, and suggestions so that we

can improve the documentation. Send your comments to

techpubs-comments@juniper.net, or fill out the documentation feedback form at

http://www.juniper.net/techpubs/docbug/docbugreport.html. If you are using e-mail, be

sure to include the following information with your comments:

•Document name

•Document part number

•Page number

•Software release version

Table 1 Icons

Icon Type Description

Information note Information that describes important features or

instructions.

Caution Information that alerts you to potential loss of

data or potential damage to an application,

system, device, or network.

Warning Information that alerts you to potential personal

injury.

Configuring DSMs

2ABOUT THIS GUIDE

Requesting

Support • Open a support case using the Case Management link at

http://www.juniper.net/support/ or call 1-888-314-JTAC (from the United States,

Canada, or Mexico) or 1-408-745-9500 (from elsewhere).

Configuring DSMs Guide

1OVERVIEW

You can configure STRM or STRM Log Management to log and correlate events

received from external sources such as security equipment (for example,

firewalls), and network equipment (for example, switches and routers). Device

Support Modules (DSMs) allows you to integrate STRM or STRM Log

Management with these external devices. Unless otherwise noted, all references

to STRM refer to both STRM and STRM Log Management.

You can configure the Event Collector to collect security events from various types

of security devices in your network. The Event Collector gathers events from local

and remote devices. The Event Collector then normalizes and bundles the events

and sends the events to the Event Processor.

All events are correlated and security and policy offenses are created based on

correlation rules. These offenses are displayed is the Offense Manager. For more

information on the Offense Manager interface, see the STRM Users Guide.

Note: Before you configure STRM to collect security information from devices, you

must set-up your deployment, including off-site sources or targets, using the

deployment editor. For more information on the deployment editor, see the STRM

Administration Guide.

To configure STRM to receive events from devices, you must:

Step 1 Configure the device to send events to STRM.

Step 2 Configure STRM to receive events from specific devices. For more information,

see the Managing Sensor Devices Guide.

Otros manuales para SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV...

Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Software de Juniper

Juniper

Juniper STRM 2008-2 - TECHNICAL NOTE CHANGING NETWORK SETTING... Manual de instrucciones

Juniper

Juniper JUNOSE 11.1.X - QUALITY OF SERVICE CONFIGURATION GUIDE... Manual de usuario

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER - LOG MANAGEMENT INSTALLATION REV... Manual de usuario

Juniper

Juniper JUNOSE SOFTWARE 11.2.X - SYSTEM EVENT LOGGING ... Manual de usuario

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - AQL EVENT AND FLOW QUERY CLI... Manual de usuario

Juniper

Juniper JUNOS PULSE 2.0 RELEASE NOTES Manual de instrucciones

Juniper

Juniper JUNOS SPACE SERVICE INSIGHT Guía de instalación

Juniper

Juniper NETWORK AND SECURITY MANAGER 2010.4 - API GUIDE REV... Manual de usuario

Juniper

Juniper BGP - CONFIGURATION GUIDE V 11.1.X Manual de usuario

Juniper

Juniper JUNOSE SOFTWARE 11.0.X - COMMAND REFERENCE A TO M... Manual de instalación

Juniper

Juniper JUNOSE 11.2.X MULTICAST ROUTING Manual de usuario

Juniper

Juniper JUNOSE 11.1.X - COMMAND REFERENCE N TO Z... Manual de instalación

Juniper

Juniper NETWORK AND SECURITY MANAGER - NSM CONFIGURATION GUIDE FOR EX SERIES DEVICES REV... Manual de usuario

Juniper

Juniper ADVANCED INSIGHT SCRIPTS 2.5 - S REV 1 Manual de instrucciones

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - S... Manual de instrucciones

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - IP-IPV6-IGP CONFIGURATION GUIDE... Manual de usuario

Juniper

Juniper JUNOSE FOR E SERIES BROADBAND SERVICES ROUTERS - S... Manual de instrucciones

Juniper

Juniper IGP - CONFIGURATION GUIDE V11.1.X Manual de usuario

Juniper

Juniper MEDIA FLOW PUBLISHER Manual de usuario

Juniper

Juniper POLICY MANAGEMENT - CONFIGURATION GUIDE... Manual de usuario

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT ADMINISTRATION GUIDE REV... Manual de usuario

Juniper

Juniper JUNIPER CARE SERVICES Manual de usuario

Juniper

Juniper NETWORK AND SECURITY MANAGER 2010.2 - ADMINISTRATION GUIDE... Manual de instrucciones

Juniper

Juniper NETWORK AND SECURITY MANAGER 2010.4 - CONFIGURING INTRUSION DETECTION PREVENTION DEVICES GUIDE REV... Manual de usuario

Manuales populares de Software de otras marcas

COMPRO

COMPRO COMPROFM Manual de usuario

Muratec

Muratec OFFICEBRIDGE ONLINE Manual de usuario

Oracle

Oracle Contact Center Anywhere 8.1 Manual de usuario

Adobe

Adobe 65007312 - Photoshop Lightroom Manual

Avaya

Avaya NULL One-X for RIM Blackberry Manual de usuario

HP ProLiant BL420c Manual de usuario

PS Audio

PS Audio PowerPlay Manual del propietario

Brady

Brady LOCKOUT PRO 3.0 Manual de servicio

Avaya

Avaya Interaction Center Manual de usuario

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manual

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manual de usuario

Oracle

Oracle Application 9i Manual de usuario

Acer

Acer RDM Manual de usuario

Canon

Canon Vixia HF21 Manual de usuario

Canon

Canon ZR950 Manual de usuario

Samsung

Samsung Auto Backup Manual de usuario

Polycom

Polycom Vortex EF2201 Instrucciones de instalación y funcionamiento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manual de usuario