Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV... User manual

Juniper Networks, Inc.
1194 North Mathilda Avenue
Sunnyvale, CA 94089
USA
408-745-2000
www.juniper.net
Part Number: 530-025620-01, Revision 1
Security Threat Response Manager
Getting Started With STRM Appliances
Release 2008.2

2
Copyright Notice
Copyright © 2008 Juniper Networks, Inc. All rights reserved. Juniper Networks and the Juniper Networks logo are registered trademarks of Juniper
Networks Inc. in the United States and other countries. All other trademarks, service marks, registered trademarks, or registered service marks in this
document are the property of Juniper Networks or their respective owners. All specifications are subject to change without notice. Juniper Networks
assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves
the right to change, modify, transfer, or otherwise revise this publication without notice.
FCC Statement
The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A
digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the
equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and
used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential
area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following
information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it
is not installed in accordance with NetScreen’s installation instructions, it may cause interference with radio and television reception. This equipment has
been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These
specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that
interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be
determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:
Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/TV
technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.
Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.
Disclaimer
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET
THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE
SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.
Getting Started With STRM Appliances
Release 2008.2
Copyright © 2008, Juniper Networks, Inc.
All rights reserved. Printed in USA.
Revision History
June 2008—Revision 1
The information in this document is current as of the date listed in the revision history.

CONTENTS
Before You Begin 1
STRM Appliance Installation and Configuration 3
QFlow Installation and Configuration 8
Before You Begin Before performing these procedures, you must have access to the following:
•Hardware Requirements — You must have access to a hard drive, monitor,
keyboard, and mouse to log in to the application.
•Java Requirements — You must install Java version 1.5.0_12. For more
information see http://java.com/.
•Browser Requirements — You must have Internet Explorer 6.0/7.0 or Firefox
2.0.
Warning: Before performing these procedures, see the safety instructions and
important regulatory information in your QRadar Installation Guide and the
Hardware Installation Guide.
Note: The graphics in this guide are representations of a QRadar appliance. Your
appliance may vary, depending on the version of QRadar or QFlow appliance you
have purchased. See the QRadar Installation Guide.
Note: When using a laptop to connect to the appliance you must use a terminal
program, such as HyperTerminal, to connect to the appliance. Be sure to set
Connect Using to the appropriate COM port of the serial connector and Bits per
second to 9600. You must also set Stop Bits (1), Data bits (8), and Parity
(None).

3
STRM Appliance Installation and Configuration
Unpack Your Appliance
Save all shipping materials in case you need
them later. (Your appliance may not include all
accessories shown.)
Install the Appliance in a Rack
See the Hardware Installation Guide for
instructions on installing your appliance in a
rack.
Connect to External Devices
Connect external devices using the ports on the
rear of the appliance. If you are using a monitor
with a keyboard, tighten the screws on the
monitor’s cable connector. You must use a USB
keyboard or a PS2 to USB adapter. If you use a
laptop, connect the laptop to the serial connector
on the rear of the appliance.
Connect to the Network
Connect the appliance to your network using the
ports on the rear of the appliance. The
Management Interface is the communications
port for your appliance; the Monitoring Interfaces
allow you to connect to span ports or taps.
If you wish to connect to a tap, see your tap
vendor documentation.
Connect to Power Source
Connect the power cable(s) to the appliance.
Next, plug the other end of the cable into a
grounded outlet on a separate power source,
such as an Uninterruptible Power Supply (UPS)
or a Power Distribution Unit (PDU). Connect the
monitor’s (or laptop) power cable to a grounded
electrical outlet.
1
2
3
4Monitoring Interface (ETH3)
Monitoring Interface (ETH2)
Monitoring Interface (ETH1)
Management Interface (ETH0)
5

4
Turn on the Appliance
Press the power button on the appliance and the
monitor or laptop. The power indicators should
light. Install the bezel after turning on the
appliance.
When the prompt appears, you are ready to log
in.
Log in as Root
Using the keyboard with monitor or laptop, log in using the default username and password.
Note: Username and password are case sensitive.
Username: root
Password: password
Press Enter. The End User Licensing Agreement window appears.
\
Read the End User Licensing Agreement
Read the End User Licensing Agreement (EULA) information. Press the Spacebar to advance to each
window until you have reached the end of the document. Type yes to accept the agreement. Press
Enter. The Activation Key window appears.
Enter Your Activation Key
The activation key is a 24-digit four-part
(separated by hyphens) alphnumeric string that
you receive from Juniper Networks. Press Next.
The Tuning Template window appears.
Select a Tuning Template
Using the up/down arrow keys, select one of the
following templates to tune your appliance:
•Enterprise - Internal network activity.
•ISP - ISP-specific concerns.
•University - Education-specific concerns.
Using the left/right arrow keys, select Next.
Press Enter. The Set the Date and Time window
appears. For more information on templates, see
the STRM Administration Guide.
Choose How to Set Date and Time
Using the up/down arrow keys, select the
method you wish to use to set the date and time.
•Manual - Allows you to manually input the
date and time. Press the spacebar to select
and then press Enter to select Next. Go to
Step 12.
•Server - Allows you to specify your time
server. Press the spacebar to select and then
press Enter to select Next. Go to Step 13.
6
7
8
9
10
10
11
11

5
Enter the Date and Time
Enter the current date and time. Using the
left/right arrow keys, select Next. Press Enter.
The Time Zone window appears.
Go to Step 14.
Enter Time Server Name
In the text field, enter the time server name or IP
address. Using the left/right arrow keys, select
Next. Press Enter. The Time Zone Continent
window appears.
Configure Time Zone
aUsing the up/down arrow keys, or the page
up/page down keys, select your time zone
continent or area.
Using the left/right arrow keys, select Next,
then press Enter. The Time Zone Region
window appears.
bThe options appearing in this window are
regions associated with the continent or area
previously selected.
Using the up/down arrow keys, or the page
up/page down keys, select your time zone
region. Using the left/right arrow keys, select
Next. Press Enter. The Configure STRM
window appears.
12
12
13
13
14
14

6
Configure STRM Settings
Using the up/down arrow keys to navigate the
fields, update the following parameters:
•Hostname - Domain name as hostname.
•IP Address - IP address of the appliance.
•Netmask - Network mask address.
•Gateway - Default gateway.
•Primary DNS - Primary DNS server.
•Secondary DNS* - Secondary DNS server.
•Public IP* - Public IP address of the server.
•EMail Server - E-mail server. If you do not
have an e-mail server, enter localhost.
* All fields are mandatory with the exception of
the Secondary DNS and Public IP.
Press Tab and then, using the left/right arrow
keys, select Next. Press Enter. The New Root
Password window appears.
Configure Passwords
aEnter your root password. Use the TAB key to
navigate to the Next option. Press Enter. The
Confirm Password window appears.
bRe-enter your password to confirm. Use the
TAB key to navigate to the Finish option and
press Enter. When STRM completes the
installation process, the Configuration is
Complete window appears.
Finish Installation
Press Enter to select OK. Type exit and press
Enter.
15
15
16
16
17
17

7
Access STRM
aOpen your web browser.
bLog in to STRM:
https://<IP Address>
Where <IP Address>is the IP address of the STRM Console. The default values are:
Username: admin
Password: <your root password>
For your STRM Console, a default key provides you access to STRM for five weeks. For more
information on the license key, see the STRM Administration Guide.
cClick OK.
The STRM interface appears. You are now ready to start tuning STRM. For more information, see the
STRM Administration Guide.
18
18

8
QFlow Installation and Configuration
Unpack Your Appliance
Save all shipping materials in case you need
them later. (Your appliance may not include all
accessories shown.)
Install the Appliance in a Rack
See the Hardware Installation Guide for
instructions on installing your appliance in a
rack.
Connect to External Devices
Connect external devices using the ports on the
rear of the appliance. If you are using a monitor
with a keyboard, tighten the screws on the
monitor’s cable connector. You must use a USB
keyboard or a PS2 to USB adapter. If you use a
laptop, connect the laptop to the serial connector
on the rear of the appliance.
Connect to the Network
Connect the appliance to your network using the
ports on the rear of the appliance. The
Management Interface is the communications
port for your appliances; the Monitoring
Interfaces allow you to connect to span ports or
taps.
If you wish to connect to a tap, see your tap
vendor documentation.
Connect to Power Source
Connect the power cable(s) to the appliance.
Next, plug the other end of the cable into a
grounded outlet on a separate power source,
such as an Uninterruptible Power Supply (UPS)
or a Power Distribution Unit (PDU). Connect the
monitor’s (or laptop) power cable to a grounded
electrical outlet.
1
2
3
4Monitoring Interface (ETH3) Monitoring Interface (ETH2
Monitoring Interface (ETH1)
Management Interface (ETH0)
5