Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV... Instruction Manual

Juniper Networks, Inc.
1194 North Mathilda Avenue
Sunnyvale, CA 94089
USA
408-745-2000
www.juniper.net
Part Number: 530-025612-01, Revision 1
Security Threat Response Manager
STRM Administration Guide
Release 2008.2

2
Copyright Notice
Copyright © 2008 Juniper Networks, Inc. All rights reserved. Juniper Networks and the Juniper Networks logo are registered trademarks of Juniper
Networks Inc. in the United States and other countries. All other trademarks, service marks, registered trademarks, or registered service marks in this
document are the property of Juniper Networks or their respective owners. All specifications are subject to change without notice. Juniper Networks
assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves
the right to change, modify, transfer, or otherwise revise this publication without notice.
FCC Statement
The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A
digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the
equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and
used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential
area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following
information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it
is not installed in accordance with NetScreen’s installation instructions, it may cause interferencewith radio and television reception. This equipment has
been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These
specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that
interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be
determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:
Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/TV
technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.
Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.
Disclaimer
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET
THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE
SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.
STRM Administration Guide
Release 2008.2
Copyright © 2008, Juniper Networks, Inc.
All rights reserved. Printed in USA.
Revision History
June 2008—Revision 1
The information in this document is current as of the date listed in the revision history.

CONTENTS
ABOUT THIS GUIDE
Audience 1
Conventions 1
Technical Documentation 1
Documentation Feedback 1
Requesting Support 2
1OVERVIEW
About the Interface 3
Accessing the Administration Console 4
Using the Interface 4
Deploying Changes 5
Viewing STRM Audit Logs 5
Logged Actions 5
Viewing the Log File 8
2MANAGING USERS
Managing Roles 11
Creating a Role 11
Editing a Role 14
Managing User Accounts 15
Creating a User Account 15
Editing a User Account 17
Disabling a User Account 17
Authenticating Users 18
3SETTING UPSTRM
Managing Your License Keys 21
Updating your License Key 22
Exporting Your License Key Information 23
Creating Your Network Hierarchy 24
Considerations 24
Defining Your Network Hierarchy 25
Scheduling Automatic Updates 28
Scheduling Automatic Updates 29
Updating Your Files On-Demand 30

Configuring STRM Settings 31
Configuring System Notifications 36
Configuring the Console Settings 39
Starting and Stopping STRM 41
Resetting SIM 41
Accessing the Embedded SNMP Agent 42
Configuring Access Settings 43
Configuring Firewall Access 43
Updating Your Host Set-up 45
Configuring Interface Roles 46
Changing Passwords 47
Updating System Time 48
4MANAGING BACKUP AND RECOVERY
Managing Backup Archives 53
Viewing Back Up Archives 53
Importing an Archive 54
Deleting a Backup Archive 55
Backing Up Your Information 56
Scheduling Your Backup 56
Initiating a Backup 58
Restoring Your Configuration Information 59
5USING THE DEPLOYMENT EDITOR
About the Deployment Editor 62
Accessing the Deployment Editor 63
Using the Editor 63
Creating Your Deployment 65
Before you Begin 65
Editing Deployment Editor Preferences 66
Building Your Flow View 66
Adding STRM Components 67
Connecting Components 69
Connecting Deployments 70
Renaming Components 73
Building Your Event View 73
Adding Components 75
Connecting Components 77
Forwarding Normalized Events 77
Renaming Components 80
Managing Your System View 80
Setting Up Managed Hosts 81
Using NAT with STRM 87
Configuring a Managed Host 91
Assigning a Component to a Host 91
Configuring Host Context 92
Configuring STRM Components 95

Configuring a Flow Collector 95
Configuring a Flow Processor 98
Configuring a Classification Engine 104
Configuring an Update Daemon 106
Configuring a Flow Writer 108
Configuring an Event Collector 109
Configuring an Event Processor 110
Configuring the Magistrate 112
6MANAGING FLOW SOURCES
About Flow Sources 115
NetFlow 115
sFlow 116
J-Flow 117
Packeteer 117
Flowlog File 118
Managing Flow Sources 118
Adding a Flow Source 118
Editing a Flow Source 120
Enabling/Disabling a Flow Source 121
Deleting a Flow Source 122
Managing Flow Source Aliases 122
Adding a Flow Source Alias 122
Editing a Flow Source Alias 123
Deleting a Flow Source Alias 124
7MANAGING SENTRIES
About Sentries 125
Viewing Sentries 126
Editing Sentry Details 127
Managing Packages 132
Creating a Sentry Package 132
Editing a Sentry Package 134
Managing Logic Units 135
Creating a Logic Unit 135
Editing a Logic Unit 138
8MANAGING VIEWS
Using STRM Views 139
About Views 139
About Global Views 140
Defining Unique Objects 141
Managing Ports View 142
Default Ports Views 142
Adding a Ports Object 142
Editing a Ports Object 144

Managing Application Views 146
Default Application Views 146
Adding an Applications Object 147
Editing an Applications Object 149
Managing Remote Networks View 151
Default Remote Networks Views 151
Adding a Remote Networks Object 151
Editing a Remote Networks Object 153
Managing Remote Services Views 154
Default Remote Services Views 154
Adding a Remote Services Object 155
Editing a Remote Services Object 156
Managing Collector Views 158
Adding a Flow Collector Object 158
Editing a Flow Collector Object 159
Managing Custom Views 161
About Custom Views 161
Editing Custom Views 170
Editing the Equation 171
Enabling and Disabling Views 172
Using Best Practices 174
9CONFIGURING RULES
Viewing Rules 176
Enabling/Disabling Rules 177
Creating a Rule 177
Event Rule Tests 194
Offense Rule Tests 203
Copying a Rule 208
Deleting a Rule 208
Grouping Rules 209
Viewing Groups 209
Creating a Group 209
Editing a Group 211
Copying an Item to Another Group(s) 211
Deleting an Item from a Group 213
Assigning an Item to a Group 213
Editing Building Blocks 213
10 DISCOVERING SERVERS
11 FORWARDING SYSLOG DATA
Adding a Syslog Destination 219
Editing a Syslog Destination 220
Delete a Syslog Destination 221

AJUNIPER NETWORKS MIB
BENTERPRISE TEMPLATE DEFAULTS
Default Sentries 237
Default Custom Views 245
IP Tracking Group 245
Threats Group 246
Attacker Target Analysis Group 249
Target Analysis Group 250
Policy Violations Group 251
ASN Source Group 252
ASN Destination Group 252
IFIndexIn Group 252
IFIndexOut Group 252
QoS Group 252
Flow Shape Group 253
Default Rules 254
Default Building Blocks 266
CUNIVERSITY TEMPLATE DEFAULTS
Default Sentries 281
Default Custom Views 289
IP Tracking Group 289
Threats Group 290
Attacker Target Analysis Group 293
Target Analysis Group 294
Policy Violations Group 295
ASN Source Group 296
ASN Destination Group 296
IFIndexIn Group 296
IFIndexOut Group 296
QoS Group 296
Flow Shape Group 297
Default Rules 298
Default Building Blocks 310
DISP TEMPLATE DEFAULTS
Default Sentries 325
Default Custom Views 328
IP Tracking Group 328
Threats Group 329
Attacker Target Analysis Group 332
Target Analysis Group 333
Policy Violations Group 334
ASN Source Group 335
ASN Destination Group 335

IFIndexIn Group 335
IFIndexIn Group 335
QoS Group 335
Flow Shape Group 336
Default Rules 337
Default Building Blocks 346
INDEX

STRM Administration Guide
ABOUT THIS GUIDE
The STRM Administration Guide provides you with information for managing
STRM functionality requiring administrative access.
Audience This guide is intended for the system administrator responsible for setting up
STRM in your network. This guide assumes that you have STRM administrative
access and a knowledge of your corporate network and networking technologies.
Conventions Table 1 lists conventions that are used throughout this guide.
Technical
Documentation You can access technical documentation, technical notes, and release notes
directly from the Juniper networks Support Web site at
http://www.juniper.net/support/.
Documentation
Feedback We encourage you to provide feedback, comments, and suggestions so that we
can improve the documentation. Send your comments to
[e-mail], or fill out the documentation feedback form at
http://www.juniper.net/techpubs/docbug/docbugreport.html. If you are using e-mail, be
sure to include the following information with your comments:
•Document name
•Document part number
Table 1 Icons
Icon Type Description
Information note Information that describes important features or
instructions.
Caution Information that alerts you to potential loss of
data or potential damage to an application,
system, device, or network.
Warning Information that alerts you to potential personal
injury.

STRM Administration Guide
2ABOUT THIS GUIDE
•Page number
•Software release version
Requesting
Support • Open a support case using the Case Management link at
http://www.juniper.net/support/ or call 1-888-314-JTAC (from the United States,
Canada, or Mexico) or 1-408-745-9500 (from elsewhere).