Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT ADMINISTRATION GUIDE REV... User manual

Juniper Networks, Inc.
1194 North Mathilda Avenue
Sunnyvale, CA 94089
USA
408-745-2000
www.juniper.net
Part Number: 530-027301-01, Revision 1
Security Threat Response Manager
Managing Sensor Devices
Release 2008.2 R2

2
Copyright Notice
Copyright © 2008 Juniper Networks, Inc. All rights reserved. Juniper Networks and the Juniper Networks logo are registered trademarks of Juniper
Networks Inc. in the United States and other countries. All other trademarks, service marks, registered trademarks, or registered service marks in this
document are the property of Juniper Networks or their respective owners. All specifications are subject to change without notice. Juniper Networks
assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves
the right to change, modify, transfer, or otherwise revise this publication without notice.
FCC Statement
The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A
digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the
equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and
used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential
area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following
information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it
is not installed in accordance with NetScreen’s installation instructions, it may cause interference with radio and television reception. This equipment has
been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These
specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that
interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be
determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:
Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/TV
technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.
Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.
Disclaimer
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET
THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE
SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.
Managing Sensor Devices
Release 2008.2 R2
Copyright © 2008, Juniper Networks, Inc.
All rights reserved. Printed in USA.
Revision History
September 2008—Revision 1
The information in this document is current as of the date listed in the revision history.

CONTENTS
ABOUT THIS GUIDE
Conventions 1
Audience 1
Technical Documentation 1
Contacting Customer Support 2
1MANAGING SENSOR DEVICES
Configuring STRM Log Management to Receive Events 3
Managing Sensor Devices 4
Adding a Sensor Device 4
Editing Sensor Devices 6
Enabling/Disabling Sensor Devices 9
Deleting a Sensor Device 9
Configuring Protocols 10
Adding a Protocol 10
Editing a Protocol 17
Deleting a Protocol 17
Grouping Sensor Devices 18
Viewing Sensor Devices Using Groups 18
Creating a Group 18
Editing a Group 19
Copying a Sensor Device to Another Group 20
Removing a Sensor Device From a Group 20
2CREATING ADEVICE EXTENSION
About Device Extensions 23
Creating a Device Extension Document 24
Viewing Device Extensions 24
Adding a Device Extension 25
Editing a Device Extension 27
Copying a Device Extension 28
Deleting a Device Extension 29
Enabling/Disabling a Device Extension 30
Reporting a Device Extension 30

Managing Sensor Devices Guide
ABOUT THIS GUIDE
The Managing Sensor Devices Guide provides you with information for configuring
sensor devices (DSMs) in the STRM Log Management interface and integrating
the DSMs with STRM Log Management.
Conventions Table 1 lists conventions that are used throughout this guide.
Audience This guide is intended for the system administrator responsible for setting up
STRM Log Management in your network. This guide assumes that you have
STRM Log Management administrative access and a knowledge of your corporate
network and networking technologies.
Technical
Documentation
You can access technical documentation, technical notes, and release notes
directly from the Juniper Networks support web site at https://juniper.net/support.
Once you access the Juniper Networks support web site, locate the product and
software release for which you require documentation.
Your comments are important to us. Please send your e-mail comments about this
guide or any of the Juniper Networks documentation to:
[e-mail]
Table 1 Icons
Icon Type Description
Information note Information that describes important features or
instructions.
Caution Information that alerts you to potential loss of data
or potential damage to an application, system,
device, or network.
Warning Information that alerts you to potential personal
injury.

Managing Sensor Devices Guide
2ABOUT THIS GUIDE
Include the following information with your comments:
•Document title
•Page number
Contacting
Customer Support
To help you resolve any issues that you may encounter when installing or
maintaining STRM Log Management, you can contact Customer Support as
follows:
•Log a support request 24/7: https://juniper.net/support/
For access to the Juniper Networks support web site, please contact Customer
Support.
•Access Juniper Networks support and Self-Service support using e-mail:
[e-mail]
•Telephone assistance: 1-800-638-8296

Managing Sensor Devices Guide
1MANAGING SENSOR DEVICES
You can configure STRM Log Management to log and correlate events received
from external sources such as security equipment (for example, firewalls and
IDSs) and network equipment (for example, switches and routers). Sensor devices
allow you to integrate STRM Log Management with these external devices. This
chapter provides information on configuring sensor devices to the system
including:
•Configuring STRM Log Management to Receive Events
•Managing Sensor Devices
•Configuring Protocols
•Grouping Sensor Devices
Configuring STRM
Log Management to
Receive Events
STRM Log Management allows you to automatically discover sensor devices in
your deployment that are sending syslog messages. Any sensor devices that are
automatically discovered by STRM Log Management appear in the Sensor
Devices window. Automatic discovery of sensor devices can be configured on a
per Event Collector basis using the Auto Detection Enabled parameter in the Event
Collector configuration. For more information, see the STRM Log Management
Administration Guide, Using the Deployment Editor.
To configure STRM Log Management to receive events from devices, you must:
Step 1 Configure the device to send events to STRM Log Management.
For information on configuring DSMs, see the Configuring DSMs Guide and your
vendor documentation.
Step 2 Configure STRM Log Management to receive events from specific devices. See
Managing Sensor Devices.
Note: You must have administrative privileges to configure sensor devices in
STRM Log Management. For more information on accessing the Administration
Console, see the STRM Log Management Administration Guide.
Step 3 Configure the necessary protocols. See Configuring Protocols.

Managing Sensor Devices Guide
4MANAGING SENSOR DEVICES
Managing Sensor
Devices
A sensor device provides events to your deployment through DSMs. Using the
Administration Console, you can:
•Add a sensor device. See Adding a Sensor Device.
•Edit an existing sensor device. See Editing Sensor Devices.
•Enable or disable a sensor device. See Enabling/Disabling Sensor Devices.
•Delete a sensor device. See Deleting a Sensor Device.
Adding a Sensor
Device
To add a sensor device to your deployment:
Step 1 In the Administration Console, click the SIM Configuration tab.
The SIM Configuration panel appears.
Step 2 Click the Sensor Devices icon.
The Sensor Devices window appears.
Step 3 Click Add.
The Add a sensor device window appears.
Step 4 Enter values for the parameters:

Managing Sensor Devices Guide
Managing Sensor Devices 5
Table 1-1 Add a Sensor Device Parameters
Parameter Description
Device Name Specify the desired name of the device.
Sensor Device Type Using the drop-down list, select the type of sensor
device you wish to add.
Protocol Configuration Using the drop-down list box, select the protocol you
wish to use for this sensor device. If the device uses
syslog, a default syslog configuration is automatically
applied. For more information on configuring protocols,
see Adding a Protocol.
Device Description Specify a description for the sensor device (optional).
Device Hostname/IP Specify the hostname or IP address for the device. If
you wish to add the device using the hostname, please
note that you must enter the hostname as it exactly
appears in the logs sent to STRM Log Management.
Otherwise, STRM Log Management will not process
the events.
Credibility Specify the credibility of the device. The range is from 0
to 10. The credibility indicates the integrity of an event
or offense as determined by the credibility rating from
source devices. Credibility increases if multiple sources
report the same event. The default is 5.
Target Event Collector Using the drop-down list box, select the Event Collector
you wish to use as the target for this device.
Coalescing Events Enables or disables the ability of a sensor device to
coalesce (bundle) events. The default is Yes.
By default, all auto detected sensor devices use the
value configured in the Coalescing Events parameter in
the STRM Settings window. However, when you create
a new sensor device or update the configuration for an
auto detected sensor device, the value configured in
the individual sensor device is the value used by the
sensor device. For more information, see the STRM
Log Management Administration Guide.
Store Event Payload Enables or disables the ability for a sensor device to
store event payload information. The default is Yes.
By default, all auto detected sensor devices use the
value configured in the Store Event Payload parameter
in the STRM Settings window. However, when you
create a new sensor device or update the configuration
for an auto detected sensor device, the value
configured in the individual sensor device is the value
used by the sensor device. For more information, see
the STRM Log Management Administration Guide.

Managing Sensor Devices Guide
6MANAGING SENSOR DEVICES
Step 5 Click Save.
The Sensor Devices window appears.
Editing Sensor
Devices
To edit a sensor device:
Step 1 In the Administration Console, click the SIM Configuration tab.
The SIM Configuration panel appears.
Step 2 Click the Sensor Devices icon.
The Sensor Devices window appears.
Step 3 Select the sensor device you wish to edit.
Step 4 Click Edit.
The Edit a sensor device window appears.
Device Extension Using the drop-down list box, select the device
extension you wish to use for this sensor device.
Device extensions allow you to immediately extend the
parsing routines of specific devices, which ensures
DSMs send valid data to STRM.
For more information on device extensions, see
Creating a Device Extension.
Extension Use Condition Using the drop-down list box, select the extension use
condition that you wish to use for this sensor device:
•Parsing Enhancement - When the DSM is unable
to parse correctly or is unable to retrieve specific
information from the DSM, the selected device
extension overrides the failed parsing by the DSM.
This is the default setting.
•Parsing Override - When the DSM parses correctly
for most fields, but needs either one or two fields
corrected, the incorrectly parsed field values are
enhanced.
Groups Select any groups of which you wish this sensor device
to be a member.
Table 1-1 Add a Sensor Device Parameters
Parameter Description

Managing Sensor Devices Guide
Managing Sensor Devices 7
Step 5 Edit values for the parameters, as necessary:
Table 1-2 Edit a Sensor Device Parameters
Parameter Description
Device Name Specify the desired name of the device.
Protocol Configuration Using the drop-down list box, select the protocol you
wish to use for this sensor device. If the device uses
syslog, a default syslog configuration is automatically
applied. For more information on configuring protocols,
see Adding a Protocol.
Device Description Specify a description for the sensor device (optional).
Device Hostname/IP Specify the hostname or IP address for the device.
Credibility Specify the credibility of the device. The range is from 0
to 10. The credibility indicates the integrity of an event
or offense as determined by the credibility rating from
source devices. Credibility increases as the multiple
sources report the same event. The default is 5.
Target Event Collector Using the drop-down list box, select the Event Collector
you wish to use as the target for this device.

Managing Sensor Devices Guide
8MANAGING SENSOR DEVICES
Step 6 Click Save.
The Sensor Devices window appears.
Coalescing Events Enables or disables the ability of a sensor device to
coalesce (bundle) events. The default is Yes.
By default, all auto detected sensor devices use the
value configured in the Coalescing Events parameter in
the STRM Settings window. However, when you create
a new sensor device or update the configuration for an
auto detected sensor device, the value configured in
the individual sensor device is the value used by the
sensor device. For more information, see the STRM
Log Management Administration Guide.
Store Event Payload Enables or disables the ability for a sensor device to
store event payload information. The default is Yes.
By default, all auto detected sensor devices use the
value configured in the Store Event Payload parameter
in the STRM Settings window. However, when you
create a new sensor device or update the configuration
for an auto detected sensor device, the value
configured in the individual sensor device is the value
used by the sensor device. For more information, see
the STRM Log Management Administration Guide.
Device Extension Using the drop-down list box, select the device
extension you wish to use for this sensor device.
Device extensions allow you to immediately extend the
parsing routines of specific devices, which ensures
DSMs send valid data to STRM.
For more information on device extensions, see
Creating a Device Extension.
Extension Use Condition Using the drop-down list box, select the extension use
condition that you wish to use for this sensor device:
•Parsing Enhancement - When the DSM is unable
to parse correctly or is unable to retrieve specific
information from the DSM, the selected device
extension overrides the failed parsing by the DSM.
This is the default setting.
•Parsing Override - When the DSM parses correctly
for most fields, but needs either one or two fields
corrected, the incorrectly parsed field values are
enhanced.
Groups Select any groups of which you wish this sensor device
to be a member.
Table 1-2 Edit a Sensor Device Parameters (continued)
Parameter Description

Managing Sensor Devices Guide
Managing Sensor Devices 9
Enabling/Disabling
Sensor Devices
To enable or disable sensor devices:
Step 1 In the Administration Console, click the SIM Configuration tab.
The SIM Configuration panel appears.
Step 2 Click the Sensor Devices icon.
The Sensor Devices window appears.
Step 3 Select the sensor device that you wish to enable or disable.
Step 4 Click Enable/Disable.
When a sensor device is enabled, the Enabled column indicates true. When a
sensor device is disabled, the Enabled column indicates false.
Note: If you are unable to enable a sensor device, you may have exceeded your
license restrictions. Consult your licensing agreement for more information.
Deleting a Sensor
Device
To delete a sensor device:
Step 1 In the Administration Console, click the SIM Configuration tab.
The SIM Configuration panel appears.
Step 2 Click the Sensor Devices icon.
The Sensor Devices window appears.
Step 3 Select the sensor device you wish to delete.
Step 4 Click Delete.
Step 5 A confirmation window appears.
Step 6 Click OK.

Managing Sensor Devices Guide
10 MANAGING SENSOR DEVICES
Configuring
Protocols
You can configure protocols for your sensor device by accessing Protocol
Configuration or Sensor Devices in the SIM Configuration tab of the Administration
Console.
The following procedures provide information on configuring protocols using the
Protocol Configurations icon in the SIM Configuration panel.
Using the Administration Console, you can:
•Add a protocol. See Adding a Protocol.
•Edit a protocol. See Editing a Protocol.
•Delete a protocol. See Deleting a Protocol.
Adding a Protocol To add a protocol:
Step 1 In the Administration Console, click the SIM Configuration tab.
The SIM Configuration panel appears.
Step 2 Click the Protocol Configuration icon.
The Sensor Device Protocol Configurations window appears.
Step 3 Click Add.
The Add a protocol configuration window appears.
Step 4 Enter values for the parameters:
•Configuration Name - Specify a name you wish to assign to this protocol
configuration.
•Protocol - Using the drop-down list box, select the protocol you wish to use for
this protocol configuration. See Step 5.
Step 5 Choose one of the following:

Managing Sensor Devices Guide
Configuring Protocols 11
a If you select JDBC, go to Step 6.
b If you select JDBC:SiteProtector, go to Step 7.
c If you select JuniperNSM, go to Step 8.
d If you select LEA, go to Step 9.
e If you select SNMP, go to Step 11.
f If you select SDEE, go to Step 10.
Step 6 If you have selected JDBC:
a Click Configure.
The JDBC Configuration window appears.
b Enter values for the parameters:
-Database Type - Using the drop-down list box, select the type of database
that you wish to use for the event source. The options include Microsoft
MSDE, Postgres, MySQL, and Oracle.
-Database Name - Specify the name of the database you wish to connect.
-Table Name - Specify the name of the table or view that includes the event
records.
-Select List - Specify the list of fields that you wish to include in the events.
You can use a comma separated list or specify * for all fields from the table
or view.
-Compare Field - Specify a numeric value or timestamp field that you wish to
use to identify new events added between queries to the table.
-Hostname - Specify the IP address or hostname of the database server.
-Port - Specify the port number used by the database server. The default is
1433.
-Username - Specify the database username.
-Password - Specify the database password.
-Polling Interval - Specify the polling interval, which is the number of
seconds between queries to the event table. The default is 10.

Managing Sensor Devices Guide
12 MANAGING SENSOR DEVICES
c Click Save.
The Protocol Configurations window appears.
Step 7 If you have selected JDBC:SiteProtector:
a Click Configure.
The configuration window appears.
b Enter values for the parameters:
-IP - Specify the IP address for the ISS SiteProtector device.
-Port - Specify the port used by the server database to listen for remote
connections. The default port is 1433.
-Username - Specify the user name. This username must match the value
entered when defining the database user when configuring ISS
SiteProtector. For more information, see the Configuring DSM Guide.
-Password - Specify the user password. This password must match the
value entered when defining the database user when configuring the IBM
Proventia Management SiteProtector. For more information, see the
Configuring DSM Guide.
-Database Name - Specify the database name for the ISS SiteProtector.
Default name is RealSecure DB.
-Table Name - Specify the table name used to store the events. Default
name is SensorData1.
c Click Save.
The Protocol Configurations window appears.
Step 8 If you selected JuniperNSM:
a Click Configure.
The Juniper NSM Configuration Parameters window appears.

Managing Sensor Devices Guide
Configuring Protocols 13
b Enter values for the parameters:
-IP or Hostname - Specify the IP address or hostname of the Juniper NSM
server.
-Inbound Port - Specify the port to which the Juniper NSM sends
communications.
-Redirection Listen Port - Specifies the port to which traffic is forwarded.
-Use NSM Address for Event Source - Select the check box if you wish to
use the Juniper NSM server’s IP address instead of the managed device’s
IP address for an event source. If you do not wish to use the Juniper NSM
server’s address, you must create a separate sensor device for each device
managed by the NSM.
c Click Save.
The Protocol Configurations window appears.
Step 9 If you selected LEA:
a Click Configure.
The LEA Configuration Parameters window appears.

Managing Sensor Devices Guide
14 MANAGING SENSOR DEVICES
b Enter values for the parameters:
-Server IP or Hostname - Specify the IP address or hostname of the server.
-Server Port - Specify the port used for OPSEC communication. The default
is 18184.
-Use Server IP for Event Source - Select the check box if you wish to use
the LEA server’s IP address instead of the managed device’s IP address for
an event source. If you do not wish to use the LEA server’s IP address, you
must create a separate sensor device for each device managed by the LEA
server.
-Statistics Report Interval - Specify the interval, in seconds, during which
the number of syslog events are recorded in the qradar.log file. The default
is 600.
-Authentication Type - Using the drop-down list box, select the
authentication type you wish to use for this LEA configuration. The options
are sslca, sslca_clear, or clear.
The following parameters appear if sslca (SSL Certificate Authority) or
sslca_clear is selected as the authentication type.
-OPSEC Application Object SIC Attribute (SIC Name) - Specify the Secure
Internal Communications (SIC) name of the OPSEC Application Object. The
SIC name is the distinguished name (DN) of the application, for example:
CN=LEA, o=fwconsole..7psasx
-Log Source SIC Attribute (Entity SIC Name) - This option only appears if
SSL Certificate Authority (sslca) or sslca_clear is selected as the
authentication type. Specify the SIC name of the server, for example:
cn=cp_mgmt,o=fwconsole..7psasx
-Specify Certificate - Select the check box if you wish to specify a certificate
for this LEA configuration. STRM Log Management attempts to retrieve the
certificate using these parameters when the certificate is required. If you
select the check box, the following parameter appears:
Certificate Filename - This option only appears if Specify Certificate is
selected. Specify the certificate you wish to use for this configuration.
If you clear the Specify Certificate check box, the following parameters
appear:
Certificate Authority IP or Hostname - Specify the IP address or hostname
of the SmartCenter server from which you wish to pull your certificate.
Pull Certificate Password - Specify the password you wish to use when
requesting a certificate.
OPSEC Application - Specify the name of the application you wish to use
when requesting a certificate.
c Click Save.
The Protocol Configurations window appears.

Managing Sensor Devices Guide
Configuring Protocols 15
Step 10 If you have selected SDEE:
a Click Configure.
The SDEE Configuration Parameters window appears.
b Enter values for the following parameters:
-URL - Specify the URL required to access the device, for example,
https://www.mysdeeserver.com/cgi-bin/sdee-server. You must use an http or
https URL.
If you are using RDEP (for Cisco IDS v4.0), the URL should have
/cgi-bin/event-server at the end. For example:
https://www.my-rdep-server.com/cgi-bin/event-server
If you are using SDEE/CIDEE (for Cisco IDS v5.x and above), the URL
should have /cgi-bin/sdee-server at the end. For example:
https://www.my-sdee-server/cgi-bin/sdee-server
-Username - Specify the user name. This username must match the SDEE
URL username used to access the SDEE URL.
-Password - Specify the user password. This password must match the
SDEE URL password used to access the SDEE URL.
-Max Events Per Query - Specify the maximum number of events to retrieve
per query. The default is 100.
-Severity Filter - Select the check boxes you wish to use to configure the
severity level. A sensor devices that supports SDEE returns only the events
that match this severity level. Options include: Low, Medium, and High. By
default, all check boxes are selected. You must have at least one check box
selected.
-Force Subscription - Select the check box if you wish to enforce this
connection. Select yes to force the server to drop it’s least active connection
to accept this connection; select no if you wish to not force this connection.
By default, the check box is selected.
c Click Save.

Managing Sensor Devices Guide
16 MANAGING SENSOR DEVICES
The Protocol Configurations window appears.
Step 11 If you have selected SNMPv2:
a Click Configure.
The SNMPv2 Configuration Parameters window appears.
b In the Community field, specify the SNMP community, such as public. This
parameter only applies if you are using SNMPv2c. The default is Public.
c Click Save.
The Protocol Configurations window appears.
Step 12 If you have selected SNMPv3:
a Click Configure.
The SNMP Configuration Parameters window appears.
b Enter values for the parameters:
-Authentication Protocol - Using the drop-down list box, select the
algorithm you wish to use to authenticate SNMP traps. This parameter is
required if you are using SNMPv3. The default is MD5.
-Authentication Password - Specify the password you wish to use to
authenticate SNMP. This parameter is required if you are using SNMPv3.
-Decryption Protocol - Using the drop-down list box, select the protocol you
wish to use to decrypt SNMP traps. This parameter is required if you are
using SNMPv3. The default is AES256.
-Decryption Password - Specify the password used to decrypt SNMP traps.
This parameter is required if you are using SNMPv3.
-User - Specify the user access for this protocol. The default is AdminUser.