Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV... User manual

Juniper Networks, Inc.
1194 North Mathilda Avenue
Sunnyvale, CA 94089
USA
408-745-2000
www.juniper.net
Part Number: 530-025608-01, Revision 1
Security Threat Response Manager
Configuring DSMs
Release 2008.2

2
Copyright Notice
Copyright © 2008 Juniper Networks, Inc. All rights reserved. Juniper Networks and the Juniper Networks logo are registered trademarks of Juniper
Networks Inc. in the United States and other countries. All other trademarks, service marks, registered trademarks, or registered service marks in this
document are the property of Juniper Networks or their respective owners. All specifications are subject to change without notice. Juniper Networks
assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves
the right to change, modify, transfer, or otherwise revise this publication without notice.
FCC Statement
The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A
digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the
equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and
used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential
area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following
information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it
is not installed in accordance with NetScreen’s installation instructions, it may cause interferencewith radio and television reception. This equipment has
been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These
specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that
interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be
determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:
Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/TV
technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.
Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.
Disclaimer
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET
THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE
SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.
Configuring DSMs
Release 2008.2
Copyright © 2008, Juniper Networks, Inc.
All rights reserved. Printed in USA.
Revision History
June 2008—Revision 1
The information in this document is current as of the date listed in the revision history.

1
1
About This Guide 1
3
Overview 3
5
3Com 8800 Series Switch 5
7
Ambiron TrustWave ipAngel 7
9
Apache HTTP Server 9
11
Apple Mac OS X 11
13
Array Network SSL VPN 13
15
F5 Networks BigIP 15
17
Blue Coat SG 17
19
Check Point FireWall-1 19
25
Check Point Provider-1 25
29
Cisco ACS 29
31
Cisco ASA 31
33
Cisco CatOS for Catalyst Switches 33
35
Cisco CSA 35
37
Cisco FWSM 37
39
Cisco IDS/IPS 39
41
Cisco NAC Device 41
43
Cisco IOS 43
45
Cisco Pix 45
47
Cisco VPN 3000 Concentrator 47
49
CyberGuard Firewall/VPN Appliance 49
51

2
Enterasys Dragon 51
55
Enterasys Matrix Router 55
57
Enterasys Matrix N-Series 57
59
Extreme Networks ExtremeWare 59
61
ForeScout CounterACT 61
63
Fortinet FortiGate 63
65
Generic Authorization Server 65
69
Generic Firewall 69
73
IBM AIX 5L 73
75
IBM Proventia Management SiteProtector 75
77
ISS Proventia 77
79
Juniper DX Application Acceleration Platform 79
81
Juniper EX-Series Ethernet Switch 81
83
Juniper NetScreen IDP 83
85
Juniper Networks Secure Access 85
89
Juniper Infranet Controller 89
91
Juniper NetScreen Firewall 91
93
Juniper NSM 93
95
Juniper Router 95
97
Juniper Steel-Belted RADUIS 97
99
Linux DHCP 99
101
Linux IPtables 101
103
Linux Login Messages 103

3
105
McAfee Intrushield 105
107
McAfee ePolicy Orchestrator 107
109
MetaInfo MetaIP 109
111
Microsoft Exchange Server 111
113
Microsoft DHCP Server 113
115
Microsoft IAS Server 115
117
Microsoft IIS 117
119
Microsoft SQL Server 119
121
Microsoft Windows Security Event Log 121
123
Niksun 123
125
Nokia Firewall 125
129
Nortel ARN 129
131
Nortel Application Switch 131
133
Nortel Contivity 5000 133
135
Nortel Contivity Firewall/VPN 135
137
Nortel Switched Firewall 5100 137
141
Nortel Switched Firewall 6000 141
145
Nortel VPN Gateway 145
147
OpenBSD 147
149
Open Source SNORT 149
151
Oracle Audit Records 151
155
Oracle DB Listener 155
159

4
ProFTPd 159
161
Samhain 161
165
Secure Computing Sidewinder 165
167
Sun Solaris 167
169
Sun Solaris DHCP 169
171
SonicWALL 171
173
Sun Solaris Sendmail 173
175
Sourcefire Intrusion Sensor 175
177
Squid Web Proxy 177
179
Symantec SGS 179
181
Symantec System Center 181
183
Symark PowerBroker 183
185
Tipping Point Intrusion Prevention System 185
187
TippingPoint X505/X506 Device 187
189
TopLayer 189
191
Trend Micro InterScan VirusWall 191
193
Tripwire 193
195
Universal DSM 195
207
Vericept Content 360 DSM 207
209
Supported DSMs 209

Configuring DSMs
ABOUT THIS GUIDE
The Configuring DSMs Guide provides you with information for configuring sensor
devices (DSMs) and integrating the DSMs with STRM or STRM Log Management.
Conventions Table 1 lists conventions that are used throughout this guide.
Technical
Documentation You can access technical documentation, technical notes, and release notes
directly from the Juniper networks Support Web site at
http://www.juniper.net/support/.
Documentation
Feedback We encourage you to provide feedback, comments, and suggestions so that we
can improve the documentation. Send your comments to
[e-mail], or fill out the documentation feedback form at
http://www.juniper.net/techpubs/docbug/docbugreport.html. If you are using e-mail, be
sure to include the following information with your comments:
•Document name
•Document part number
•Page number
•Software release version
Table 1 Icons
Icon Type Description
Information note Information that describes important features or
instructions.
Caution Information that alerts you to potential loss of
data or potential damage to an application,
system, device, or network.
Warning Information that alerts you to potential personal
injury.

Configuring DSMs
2ABOUT THIS GUIDE
Requesting
Support • Open a support case using the Case Management link at
http://www.juniper.net/support/ or call 1-888-314-JTAC (from the United States,
Canada, or Mexico) or 1-408-745-9500 (from elsewhere).

Configuring DSMs Guide
1OVERVIEW
You can configure STRM or STRM Log Management to log and correlate events
received from external sources such as security equipment (for example,
firewalls), and network equipment (for example, switches and routers). Device
Support Modules (DSMs) allows you to integrate STRM or STRM Log
Management with these external devices. Unless otherwise noted, all references
to STRM refer to both STRM and STRM Log Management.
You can configure the Event Collector to collect security events from various types
of security devices in your network. The Event Collector gathers events from local
and remote devices. The Event Collector then normalizes and bundles the events
and sends the events to the Event Processor.
All events are correlated and security and policy offenses are created based on
correlation rules. These offenses are displayed is the Offense Manager. For more
information on the Offense Manager interface, see the STRM Users Guide.
Note: Before you configure STRM to collect security information from devices, you
must set-up your deployment, including off-site sources or targets, using the
deployment editor. For more information on the deployment editor, see the STRM
Administration Guide.
To configure STRM to receive events from devices, you must:
Step 1 Configure the device to send events to STRM.
Step 2 Configure STRM to receive events from specific devices. For more information,
see the Managing Sensor Devices Guide.