Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT ADMINISTRATION GUIDE REV... User manual

Juniper Networks, Inc.
1194 North Mathilda Avenue
Sunnyvale, CA 94089
USA
408-745-2000
www.juniper.net
Part Number: 530-027300-01, Revision 1
Security Threat Response Manager
STRM Log Management Users Guide
Release 2008.2 R2

2
Copyright Notice
Copyright © 2008 Juniper Networks, Inc. All rights reserved. Juniper Networks and the Juniper Networks logo are registered trademarks of Juniper
Networks Inc. in the United States and other countries. All other trademarks, service marks, registered trademarks, or registered service marks in this
document are the property of Juniper Networks or their respective owners. All specifications are subject to change without notice. Juniper Networks
assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves
the right to change, modify, transfer, or otherwise revise this publication without notice.
FCC Statement
The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A
digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the
equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and
used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential
area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following
information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it
is not installed in accordance with NetScreen’s installation instructions, it may cause interference with radio and television reception. This equipment has
been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These
specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that
interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be
determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:
Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/TV
technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.
Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.
Disclaimer
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET
THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE
SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.
STRM Log Management Users Guide
Release 2008.2 R2
Copyright © 2008, Juniper Networks, Inc.
All rights reserved. Printed in USA.
Revision History
September 2008—Revision 1
The information in this document is current as of the date listed in the revision history.

CONTENTS
ABOUT THIS GUIDE
Conventions 1
Technical Documentation 1
Contacting Customer Support 1
1ABOUT STRM LOG MANAGEMENT SLIM
Logging In to STRM Log Management 3
Dashboard 4
Event Viewer 5
Reports 5
Using STRM Log Management 6
Sorting Results 6
Refreshing the Interface 6
Pausing the Interface 6
Investigating IP Addresses 6
STRM Log Management Time 7
Accessing On-line Help 7
STRM Log Management Administration Console 8
2USING THE DASHBOARD
About the Dashboard 9
Using the Dashboard 10
Event Viewer 10
Events Over Time 10
Events By Severity 11
Top Devices 11
Reports 12
System Summary 12
Adding Items 13
3USING THE EVENT VIEWER
Using the Event Viewer Interface 16
Using the Toolbar 16
Using the Right-Click Menu Options 16
Viewing Events 17
Viewing Normalized Events 17

Viewing Raw Events 20
Viewing Aggregate Normalized Events 21
Using the Search 27
Searching Events 27
Deleting Saved Searches 30
Modifying Event Mapping 31
Exporting Events 33
4CONFIGURING RULES
Viewing Rules 36
Enabling/Disabling Rules 37
Creating a Rule 37
Event Rule Tests 47
Copying a Rule 52
Deleting a Rule 53
Grouping Rules 53
Viewing Groups 53
Creating a Group 54
Editing a Group 55
Copying an Item to Another Group(s) 56
Deleting an Item from a Group 57
Assigning an Item to a Group 58
Editing Building Blocks 58
5MANAGING REPORTS
Using the Reports Interface 62
Using the Navigation Menu 62
Using the Toolbar 63
Viewing Reports 63
Grouping Reports 64
Creating a Group 65
Editing a Group 66
Copying a Template to Another Group 66
Deleting a Template From a Group 67
Assigning a Report to a Group 68
Creating a Report 68
Creating a Template 69
Configuring Charts 76
Selecting a Graph Type 85
Using Default Report Templates 86
Generating a Report 87
Duplicating a Report 87
Sharing a Report 88
Branding Your Report 88

ADEFAULT RULES AND BUILDING BLOCKS
Default Rules 91
Default Building Blocks 101
AGLOSSARY
INDEX

STRM Log Management Users Guide
ABOUT THIS GUIDE
The STRM Log Management Users Guide provides information on managing
STRM Log Management including the Dashboard, Reports, and Event Viewer
interfaces.
Conventions Table 1 lists conventions that are used throughout this guide.
Technical
Documentation
You can access technical documentation, technical notes, and release notes
directly from the Juniper Networks support web site at https://juniper.net/support.
Once you access the Juniper Networks support web site, locate the product and
software release for which you require documentation.
Your comments are important to us. Please send your e-mail comments about this
guide or any of the Juniper Networks documentation to:
[e-mail].
Include the following information with your comments:
•Document title
•Page number
Table 1 Icons
Icon Type Description
Information note Information that describes important features or
instructions.
Caution Information that alerts you to potential loss of
data or potential damage to an application,
system, device, or network.
Warning Information that alerts you to potential personal
injury.

STRM Log Management Users Guide
2ABOUT THIS GUIDE
Contacting
Customer Support
To help you resolve any issues that you may encounter when installing or
maintaining STRM Log Management, you can contact Customer Support as
follows:
•Log a support request 24/7: https://juniper.net/support
For access to the Juniper Networks support web site, please contact Customer
Support.
•Access Juniper Networks support and Self-Service support using e-mail:
[e-mail]
•Telephone assistance: 1-800-638-8296.

STRM Log Management Users Guide
1ABOUT STRM LOG MANAGEMENT
STRM Log Management is a network security management platform that provides
situational awareness and compliance support through security event correlation,
analysis, and reporting. This chapter provides an overview of the STRM Log
Management interface including:
•Logging In to STRM Log Management
•Dashboard
•Event Viewer
•Reports
•Using STRM Log Management
•STRM Log Management Administration Console
Note: When navigating STRM Log Management, do not use the browser Back
button. Use the navigation options available with STRM Log Management to
navigate the interface.
Logging In to STRM
Log Management
To login to STRM Log Management:
Step 1 Open your web browser.
Step 2 Log in to STRM Log Management:
https://<IP Address>
Where <IP Address>is the IP address of the STRM Log Management system.
The default values are:
Username: admin
Password: <root password>
Where <root password> is the password assigned to STRM Log Management
during the installation process. For more information, see the STRM Log
Management Installation Guide.
Step 3 Click Login To STRM Log Management.
For your STRM Log Management Console, a default license key provides you
access to the interface for 5 weeks. A window appears providing the date that the

STRM Log Management Users Guide
4ABOUT STRM LOG MANAGEMENT
temporary license key will expire. For information on installing a permanent license
key, see the STRM Log Management Administration Guide.
Dashboard The Dashboard tab is the default interface that appears when you log in to STRM
Log Management. The Dashboard tab provides summary and detailed information
on events occurring on your network. The Dashboard is customizable on a per
user basis to focus on individual user’s security or network operations
responsibilities.
Note: For more information on using the Dashboard, see Chapter 2 Using the
Dashboard.