Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV... Manual de usuario

Juniper Networks, Inc.

1194 North Mathilda Avenue

Sunnyvale, CA 94089

USA

408-745-2000

www.juniper.net

Part Number: 530-025609-01, Revision 1

Security Threat Response Manager

Category Offense Investigation Guide

Release 2008.2

2

Networks Inc. in the United States and other countries. All other trademarks, service marks, registered trademarks, or registered service marks in this

document are the property of Juniper Networks or their respective owners. All specifications are subject to change without notice. Juniper Networks

assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves

the right to change, modify, transfer, or otherwise revise this publication without notice.

FCC Statement

The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A

digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the

equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and

used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential

area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following

information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it

is not installed in accordance with NetScreen’s installation instructions, it may cause interferencewith radio and television reception. This equipment has

been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These

specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that

interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be

determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:

Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/TV

technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.

Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.

Disclaimer

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET

THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE

SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.

Category Offense Investigation Guide

Release 2008.2

Revision History

June 2008—Revision 1

The information in this document is current as of the date listed in the revision history.

CONTENTS

ABOUT THIS GUIDE

Documentation Feedback 1

Requesting Support 1

1ACCESS OFFENSES

What is an Access Offense? 3

How do I Investigate an Access Offense? 4

How do I Tune an Access Offense? 7

2SIM AUDIT OFFENSES

What is SIM Audit? 9

How do I Investigate a SIM Audit Offense? 9

How do I Tune a SIM Audit Offense? 12

Tuning Using False Positive Function 12

Tuning Using Custom Rules Wizard 14

3AUTHENTICATION OFFENSES

What is an Authentication Offense? 17

How do I Investigate an Authentication Offense? 17

How do I Tune an Authentication Offense? 21

4CRE OFFENSES

What is a CRE Offense? 23

How do I Investigate a CRE Offense? 23

How do I Tune a CRE Offense? 26

5DENIAL OF SERVICE (DOS) OFFENSES

What is a DoS Offense? 27

What is a DoS Flood Attack? 27

What is a DoS Service Exploit? 28

How do I Investigate a DoS Offense? 28

How do I Tune a DoS Offense? 32

Tuning Using False Positive Function 32

Tuning Using Sentries 33

Tuning Using Custom Rules Wizard 33

How Can I Verify If STRM is Receiving Valid DoS Offenses? 34

6EXPLOIT OFFENSES

What is an Exploit Attack? 35

How do I Investigate an Exploit Offense 35

How do I Tune an Exploit Offenses? 39

How Can I Verify That STRM is Receiving Valid Exploit Offenses? 40

7MALWARE OFFENSES

What is Malware? 41

What is a Malware Offense? 41

How do I Investigate a Malware Offense? 42

How do I Tune a Malware Offense? 45

8NETWORK ANOMALIES OFFENSES

What is an Network Anomaly Offense? 47

Policy 47

Threshold 47

Anomaly 48

Behavior 48

How do I Investigate a Network Anomaly Offense 48

How do I Tune a Network Anomaly Offense? 50

9POLICY OFFENSES

What is a Policy Offense? 51

How do I Investigate a Policy Offense? 51

How do I Tune a Policy Offense? 54

Tuning Using False Positive Function 54

Tuning Using Custom Rules Wizard 55

How Can I Verify That STRM is Receiving Valid Offenses? 55

10 POTENTIAL EXPLOIT OFFENSES

What is a Potential Exploit Offense? 57

How do I Investigate a Potential Exploit Offense? 57

How do I Tune a Potential Exploit Offense? 59

11 RECONNAISSANCE OFFENSES

What is Reconnaissance? 61

What is Network Reconnaissance? 61

What is a Reconnaissances Offense? 61

How do I Investigate a Reconnaissance Offense? 62

How do I Tune a Reconnaissance Offense? 65

Tuning Using False Positive Function 65

Tuning Using Custom Rules Wizard 67

12 SUSPICIOUS ACTIVITY OFFENSES

What is a Suspicious Attack? 69

What is Suspicious Traffic? 69

What is a Suspicious Offense? 69

How do I Investigate Suspicious Offense 70

How do I Tune a Suspicious Offenses? 73

13 SYSTEM OFFENSES

What is a System Offense? 77

How do I Investigate a System Offense? 77

How do I Tune a System Offense? 80

How Can I Verify That STRM is Receiving Valid Offenses? 81

14 USER DEFINED OFFENSES

What is a User Defined Offense? 83

How do I Investigate a User Defined Offense? 83

How do I Tune a User Defined Offense? 86

Category Offense Investigation Guide

ABOUT THIS GUIDE

This preface provides the following guidelines for using the Category Offense

Investigation Guide:

•Documentation Feedback

•Requesting Support

Documentation

Feedback We encourage you to provide feedback, comments, and suggestions so that we

can improve the documentation. Send your comments to

techpubs-comments@juniper.net, or fill out the documentation feedback form at

http://www.juniper.net/techpubs/docbug/docbugreport.html. If you are using e-mail,

be sure to include the following information with your comments:

•Document name

•Document part number

•Page number

•Software release version

Requesting

Support Open a support case using the Case Management link at http://www.juniper.net/support/

or call 1-888-314-JTAC (from the United States, Canada, or Mexico) or

1-408-745-9500 (from elsewhere).

Offense Category Investigation Guide

1ACCESS OFFENSES

This chapter provides information on access offenses including:

•What is an Access Offense?

•How do I Investigate an Access Offense?

•How do I Tune an Access Offense?

What is an Access

Offense? Limiting access to your network and networked resources is an essential

component of any network security strategy. In most cases, this is accomplished

using firewalls. Monitoring the activity of the firewalls in your network is a massive

undertaking for most organizations since the amount of logs generated can be

overwhelming. STRM intelligently collects and analyzes firewall logs and then

automatically reports any abnormal and/or suspicious behavior.

STRM generates offenses based on access related behavior when a user is

attempting to gain illegal access to your network. By analyzing the firewall and

other intrusion prevention device logs, STRM determines when a particular IP

address has been denied access in a manner that requires investigation. STRM

can also detect suspicious failed access to the same destination as well as

multiple attempts across many distributed destinations.

Offense Category Investigation Guide

4ACCESS OFFENSES

How do I

Investigate an

Access Offense?

To investigate an access offense:

Step 1 Click the Offense Manager tab.

The Offense Manager window appears.

Step 2 Click By Category from the navigation menu.

The By Category view appears displaying high-level categories. The counts for

each category are accumulated from the values in the low-level categories.

Hint: Only low-level categories with associated offenses appear with an arrow.

You can click the arrow to view the associated low-level categories. If you wish to

view all categories, click Show Inactive Categories.

Step 3 To view additional low-level category information for the Access category, click the

arrow icon next to Access.

Step 4 Double-click any low-level category to view the list of associated offenses.

The list of offenses appear.

Otros manuales para SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV...

Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Software de Juniper

Juniper

Juniper JUNOSE SOFTWARE 10.2.2 - S 6-4-2010 Manual de instrucciones

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - EVENT CATEGORY CORRELATION REV... Manual de usuario

Juniper

Juniper JUNOS PULSE 2.0 RELEASE NOTES Manual de instrucciones

Juniper

Juniper JUNOS SPACE SERVICE NOW Manual de usuario

Juniper

Juniper JUNOS OS 10.4 - PROTECTED SYSTEM DOMAIN Manual de usuario

Juniper

Juniper JUNOSE 11.0.X MULTICAST ROUTING Manual de usuario

Juniper

Juniper JUNOS OS 10.3 - XML MANAGEMENT PROTOCOL GUIDE... Manual de instalación

Juniper

Juniper NETWORK AND SECURITY MANAGER - NSM CONFIGURATION GUIDE FOR EX SERIES DEVICES REV... Manual de usuario

Juniper

Juniper JUNOS OS 10.4 - S REV 5 Manual de instrucciones

Juniper

Juniper JUNOS OS 10.3 - XML MANAGEMENT PROTOCOL GUIDE... Manual de usuario

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - INSTALLATION... Manual de usuario

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT ADMINISTRATION GUIDE REV... Manual de usuario

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - MANAGING VULNERABILITY ASSESSMENT... Manual de usuario

Juniper

Juniper NETWORK AND SECURITY MANAGER NSMXPRESS - ... Manual de usuario

Juniper

Juniper MEDIA FLOW PUBLISHER Manual de usuario

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV... Manual de usuario

Juniper

Juniper POLICY MANAGEMENT - CONFIGURATION GUIDE... Manual de usuario

Juniper

Juniper JUNOSE 11.2.X BGP AND MPLS Manual de usuario

Juniper

Juniper STRM 2008-2 - TECHNICAL NOTE CHANGING NETWORK SETTING... Manual de instrucciones

Juniper

Juniper JUNOS SPACE 2.0 - RELEASE NOTES Manual de usuario

Juniper

Juniper JUNOS OS 10.3 - SYSTEM LOG MESSAGES REFERENCE... Manual de usuario

Juniper

Juniper NETWORK AND SECURITY MANAGER NSMXPRESS SERIES II - ... Manual de usuario

Juniper

Juniper JUNOS SPACE 2.0 - RELEASE NOTES Manual de instrucciones

Juniper

Juniper JUNOS OS 10.4 RELEASE NOTES Manual de instrucciones

Manuales populares de Software de otras marcas

COMPRO

COMPRO COMPROFM Manual de usuario

Muratec

Muratec OFFICEBRIDGE ONLINE Manual de usuario

Oracle

Oracle Contact Center Anywhere 8.1 Manual de usuario

Adobe

Adobe 65007312 - Photoshop Lightroom Manual

Avaya

Avaya NULL One-X for RIM Blackberry Manual de usuario

HP ProLiant BL420c Manual de usuario

PS Audio

PS Audio PowerPlay Manual del propietario

Brady

Brady LOCKOUT PRO 3.0 Manual de servicio

Avaya

Avaya Interaction Center Manual de usuario

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manual

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manual de usuario

Oracle

Oracle Application 9i Manual de usuario

Acer

Acer RDM Manual de usuario

Canon

Canon Vixia HF21 Manual de usuario

Canon

Canon ZR950 Manual de usuario

Samsung

Samsung Auto Backup Manual de usuario

Polycom

Polycom Vortex EF2201 Instrucciones de instalación y funcionamiento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manual de usuario