Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT ADMINISTRATION GUIDE REV... User manual

Juniper Networks, Inc.
1194 North Mathilda Avenue
Sunnyvale, CA 94089
USA
408-745-2000
www.juniper.net
Part Number: 530-027300-01, Revision 1
Security Threat Response Manager
STRM Log Management Users Guide
Release 2008.2 R2

2
Copyright Notice
Copyright © 2008 Juniper Networks, Inc. All rights reserved. Juniper Networks and the Juniper Networks logo are registered trademarks of Juniper
Networks Inc. in the United States and other countries. All other trademarks, service marks, registered trademarks, or registered service marks in this
document are the property of Juniper Networks or their respective owners. All specifications are subject to change without notice. Juniper Networks
assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves
the right to change, modify, transfer, or otherwise revise this publication without notice.
FCC Statement
The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A
digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the
equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and
used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential
area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following
information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it
is not installed in accordance with NetScreen’s installation instructions, it may cause interference with radio and television reception. This equipment has
been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These
specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that
interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be
determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:
Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/TV
technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.
Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.
Disclaimer
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET
THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE
SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.
STRM Log Management Users Guide
Release 2008.2 R2
Copyright © 2008, Juniper Networks, Inc.
All rights reserved. Printed in USA.
Revision History
September 2008—Revision 1
The information in this document is current as of the date listed in the revision history.

CONTENTS
ABOUT THIS GUIDE
Conventions 1
Technical Documentation 1
Contacting Customer Support 1
1ABOUT STRM LOG MANAGEMENT SLIM
Logging In to STRM Log Management 3
Dashboard 4
Event Viewer 5
Reports 5
Using STRM Log Management 6
Sorting Results 6
Refreshing the Interface 6
Pausing the Interface 6
Investigating IP Addresses 6
STRM Log Management Time 7
Accessing On-line Help 7
STRM Log Management Administration Console 8
2USING THE DASHBOARD
About the Dashboard 9
Using the Dashboard 10
Event Viewer 10
Events Over Time 10
Events By Severity 11
Top Devices 11
Reports 12
System Summary 12
Adding Items 13
3USING THE EVENT VIEWER
Using the Event Viewer Interface 16
Using the Toolbar 16
Using the Right-Click Menu Options 16
Viewing Events 17
Viewing Normalized Events 17

Viewing Raw Events 20
Viewing Aggregate Normalized Events 21
Using the Search 27
Searching Events 27
Deleting Saved Searches 30
Modifying Event Mapping 31
Exporting Events 33
4CONFIGURING RULES
Viewing Rules 36
Enabling/Disabling Rules 37
Creating a Rule 37
Event Rule Tests 47
Copying a Rule 52
Deleting a Rule 53
Grouping Rules 53
Viewing Groups 53
Creating a Group 54
Editing a Group 55
Copying an Item to Another Group(s) 56
Deleting an Item from a Group 57
Assigning an Item to a Group 58
Editing Building Blocks 58
5MANAGING REPORTS
Using the Reports Interface 62
Using the Navigation Menu 62
Using the Toolbar 63
Viewing Reports 63
Grouping Reports 64
Creating a Group 65
Editing a Group 66
Copying a Template to Another Group 66
Deleting a Template From a Group 67
Assigning a Report to a Group 68
Creating a Report 68
Creating a Template 69
Configuring Charts 76
Selecting a Graph Type 85
Using Default Report Templates 86
Generating a Report 87
Duplicating a Report 87
Sharing a Report 88
Branding Your Report 88

ADEFAULT RULES AND BUILDING BLOCKS
Default Rules 91
Default Building Blocks 101
AGLOSSARY
INDEX

STRM Log Management Users Guide
ABOUT THIS GUIDE
The STRM Log Management Users Guide provides information on managing
STRM Log Management including the Dashboard, Reports, and Event Viewer
interfaces.
Conventions Table 1 lists conventions that are used throughout this guide.
Technical
Documentation
You can access technical documentation, technical notes, and release notes
directly from the Juniper Networks support web site at https://juniper.net/support.
Once you access the Juniper Networks support web site, locate the product and
software release for which you require documentation.
Your comments are important to us. Please send your e-mail comments about this
guide or any of the Juniper Networks documentation to:
[e-mail].
Include the following information with your comments:
•Document title
•Page number
Table 1 Icons
Icon Type Description
Information note Information that describes important features or
instructions.
Caution Information that alerts you to potential loss of
data or potential damage to an application,
system, device, or network.
Warning Information that alerts you to potential personal
injury.

STRM Log Management Users Guide
2ABOUT THIS GUIDE
Contacting
Customer Support
To help you resolve any issues that you may encounter when installing or
maintaining STRM Log Management, you can contact Customer Support as
follows:
•Log a support request 24/7: https://juniper.net/support
For access to the Juniper Networks support web site, please contact Customer
Support.
•Access Juniper Networks support and Self-Service support using e-mail:
[e-mail]
•Telephone assistance: 1-800-638-8296.

STRM Log Management Users Guide
1ABOUT STRM LOG MANAGEMENT
STRM Log Management is a network security management platform that provides
situational awareness and compliance support through security event correlation,
analysis, and reporting. This chapter provides an overview of the STRM Log
Management interface including:
•Logging In to STRM Log Management
•Dashboard
•Event Viewer
•Reports
•Using STRM Log Management
•STRM Log Management Administration Console
Note: When navigating STRM Log Management, do not use the browser Back
button. Use the navigation options available with STRM Log Management to
navigate the interface.
Logging In to STRM
Log Management
To login to STRM Log Management:
Step 1 Open your web browser.
Step 2 Log in to STRM Log Management:
https://<IP Address>
Where <IP Address>is the IP address of the STRM Log Management system.
The default values are:
Username: admin
Password: <root password>
Where <root password> is the password assigned to STRM Log Management
during the installation process. For more information, see the STRM Log
Management Installation Guide.
Step 3 Click Login To STRM Log Management.
For your STRM Log Management Console, a default license key provides you
access to the interface for 5 weeks. A window appears providing the date that the

STRM Log Management Users Guide
4ABOUT STRM LOG MANAGEMENT
temporary license key will expire. For information on installing a permanent license
key, see the STRM Log Management Administration Guide.
Dashboard The Dashboard tab is the default interface that appears when you log in to STRM
Log Management. The Dashboard tab provides summary and detailed information
on events occurring on your network. The Dashboard is customizable on a per
user basis to focus on individual user’s security or network operations
responsibilities.
Note: For more information on using the Dashboard, see Chapter 2 Using the
Dashboard.

STRM Log Management Users Guide
Event Viewer 5
Event Viewer The Event Viewer allows you to view event logs being sent to STRM Log
Management in real-time, or through searches. The Event Viewer is a powerful
tool for performing in-depth investigations on event data.
Note: For more information, see Chapter 3 Using the Event Viewer.
Reports Reports is a flexible and robust reporting package that allows you to create,
distribute, and manage reports for any data within STRM Log Management.
Reports allows you to create customized reports for operational and executive use
by combining any combination of information into a single report. You can also use
the many pre-installed report templates included with STRM Log Management.
The Reports tab also allows you to brand your reports with your customized logos
enabling you to support various unique logos for each report. This is beneficial for
distributing reporting to different audiences.
Note: For more information on Reports, see Chapter 5 Managing Reports.

STRM Log Management Users Guide
6ABOUT STRM LOG MANAGEMENT
Using STRM Log
Management
Using STRM Log Management, you can:
•Sort the results. See Sorting Results.
•Refresh the interface. See Refreshing the Interface.
•Pause the current display. See Pausing the Interface.
•Further investigate an IP address. See Investigating IP Addresses.
•View the time of the STRM Log Management Console. See STRM Log
Management Time.
•View the STRM Log Management on-line Help. See Accessing On-line Help
Sorting Results In the Event Viewer tab you can sort the resulting tables by clicking on a column
heading. A single click of the desired column sorts the results in descending order
and a second click on the heading sorts the results in ascending order. An arrow at
the top of the column indicates the direction of the sort.
For example, if you wish to sort the events by Name, click the Name heading. An
arrow appears in the column heading to indicate the results are sorted in
descending order.
Click the Name column heading again if you wish to sort the information in
ascending order.
Refreshing the
Interface
The Event Viewer and the Dashboard allow you to refresh the interface. This
refresh option is located in the right corner of the interface. The timer indicates the
amount of time since the interface was refreshed. To refresh the interface, click the
refresh icon.
Pausing the Interface You can use the refresh timer, located on the right, to pause the current display. To
pause the interface, click the pause icon . The timer flashes red to indicate the
current display is paused. Click the icon again to restart the timer.
Investigating IP
Addresses
You can use the right-mouse button (right-click) on any IP address to access
additional menus, which allow you to further investigate that IP address. The menu
options include:
Note: For information on customizing the right-click menu, see the Customizing
the Right-Click Menu Technical Note.

STRM Log Management Users Guide
Using STRM Log Management 7
STRM Log
Management Time
The right corner of the STRM Log Management interface displays STRM Log
Management time, which is the time of the STRM Log Management Console. The
STRM Log Management Console time synchronizes all STRM Log Management
appliances within the STRM Log Management deployment, and is used to
determine the time events were received from other devices for proper time sync
correlation.
Accessing On-line
Help
You can access the STRM Log Management on-line Help through the main STRM
Log Management interface. To access the on-line Help, click Help > Help
Contents. The Help interface appears.
Table 1-1 Additional Options
Menu Sub-Menu Description
Information DNS Lookup Searches for DNS entries based on the IP
address.
WHOIS Lookup Searches for the registered owner of a
remote IP address (Default system server:
whois.crsnic.net.)
Port Scan Performs a NMAP scan of the selected IP
address. This option is only available if
NMAP is installed on your system. For more
information on installing NMAP, see your
vendor documentation.

STRM Log Management Users Guide
8ABOUT STRM LOG MANAGEMENT
STRM Log
Management
Administration
Console
The STRM Log Management Administration Console is a client-based application
that provides administrative users access to administrative functionality including:
•System Configuration - Allows you configure system wide STRM Log
Management settings including, users, thresholds, system settings, backup and
recovery, license keys, network hierarchy, authentication, or automatic
updates.
•Access the deployment editor - Allows you to manage the individual
components of your STRM Log Management deployment.
•Configure sensor devices - Allows you to configure sensor devices, which
provide events to your deployment through DSMs.
All configuration updates using the Administration Console are saved to a staging
area. Once all changes are complete, you can deploy the configuration changes or
all configuration settings to the remainder of your deployment.
For more information regarding the STRM Log Management Administration
Console, see the STRM Log Management Administration Guide.

STRM Log Management Users Guide
2USING THE DASHBOARD
The Dashboard allows you to create a customized portal to monitor any data
STRM Log Management collects, to which you have access. The Dashboard is the
default view when you log in to STRM Log Management and allows you to monitor
several areas of your network at the same time. Normal activity and suspicious
behaviors can be investigated directly from the Dashboard. Also, you can detach
an item and monitor the item directly from your desktop.
This chapter includes:
•About the Dashboard
•Event Viewer
•Reports
•System Summary
•Adding Items
About the
Dashboard
The Dashboard allows you to monitor your security event behavior. By default, for
non-administrative users, the Dashboard is empty. For administrative users, the
Dashboard displays the following:
•System Summary
•Events - Average Events Per Second
•Events By Severity
•Most Recent Reports
•Top Devices
Note: The items that appear on your Dashboard depends on the access you have
been granted. For more information on user roles, see the STRM Log
Management Administration Guide.
The content that appears on the Dashboard is user-specific. You can design the
Dashboard as you wish, as the changes made within a STRM Log Management
session affect only your system. The next time you log in, STRM Log Management
reflects your last Dashboard configuration.

STRM Log Management Users Guide
10 USING THE DASHBOARD
You can move and position items to meet your requirements. You can stack items
in one panel or distribute them evenly within the three panels. When positioning
items, each item automatically resizes in proportion to the panel. The Dashboard
interface refreshes regularly to display the most recent information.
Using the Dashboard You can add, remove, or detach items on the Dashboard. Once added, each item
appears with a titlebar. Using the Dashboard, you can:
•Adding Items - Provides the list of items that you can add to your Dashboard.
You can monitor the following items:
- Event Viewer
- Reports
- System Summary
•Removing an Item - To remove an item from the Dashboard, click the red icon
located in the upper right corner of the item.
A confirmation window appears before an item is removed. Removing an item
does not remove the item from STRM Log Management. Removing an item
clears the item from the Dashboard. You can add the item again at any time.
•Detaching an Item - To detach an item from the Dashboard, click the green
icon located in the upper right of the item. Detaching an item does not remove
the item from STRM Log Management; detaching an item duplicates the data in
a new window.
Detaching an item allows you to temporarily monitor one or more particular
items on your desktop. You can detach the item then remove the item from the
Dashboard - the detached window remains open and refreshes during
scheduled intervals. If you close the STRM Log Management application, the
detached window remains open for monitoring and continues to refresh until
you manually close the window or shut down your computer system.
Note: STRM Log Management does not save the status of a detached Dashboard
item when you end your STRM Log Management session.
Event Viewer You can add several Event Viewer items to your Dashboard. The Event Viewer
allows you to monitor and investigate events in real-time. Event Viewer options
include:
•Events Over Time
•Events By Severity
•Top Devices
Events Over Time The Events Over Time option displays events received over the last 8 hours in 15
minute intervals, categorized by the event category.

STRM Log Management Users Guide
Event Viewer 11
Note: You must have the required permissions to access Event Viewer items.
To customize your display:
•Period of Time - Using the drop-down list box, select the period of time you
wish the Dashboard graph to display.
•Chart Type - You can display the data using a Time Series (default), Line
Chart, or Pie Chart. To change the chart type, click Time Series, Line Chart or
Pie Chart at the top of the graph.
Events By Severity The Events By Severity item displays a pie chart that specifies the number of
active events grouped by severity. This item allows you to see the number of
events that are being received by the level of severity that has been assigned.
Severity indicates the amount of threat an attacker poses in relation to how
prepared the target is for the attack. The range of severity is 0 (low) to 10 (high).
Top Devices The Top Devices item displays a pie chart that specifies the top 10 devices that
sent events to STRM Log Management within the last 15 minutes. The number of
events sent from the specified device is indicated in the pie chart. This item allows

STRM Log Management Users Guide
12 USING THE DASHBOARD
you to view potential changes in behavior, for example, if a firewall device that is
typically not in the top 10 list is now contributing to a large percentage of the
overall message count, you should investigate this occurrence.
Reports The Reports option allows you to display the top recently generated reports. The
display provides the report title, the time and date the report was generated, and
the format of the report.
System Summary The Summary item provides a high-level summary of activity within the past 24
hours. Within the summary item, you can view the following information:
•Current Events Per Second - Specifies the number of current events per
second.
•New Events (Past 24 Hours) - Specifies the total number of new events
received within the last 24 hours.

STRM Log Management Users Guide
Adding Items 13
Adding Items You can add multiple displays to the Dashboard interface. To add an item to the
Dashboard:
Step 1 Click the Dashboard tab.
The Dashboard interface appears.
Step 2 From the toolbar, click Add Item.
A list of menu items appears.
Step 3 Navigate through the categories, options include:
•Event Viewer
•Reports
•System Summary
Each panel highlights as you pass an item over the panel signalling an item can be
dropped into that panel. If the item titlebar is above the titlebar of an existing item,
the new item assumes position above the existing item.