Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV... Manuale utente

Juniper Networks, Inc.

1194 North Mathilda Avenue

Sunnyvale, CA 94089

USA

408-745-2000

www.juniper.net

Part Number: 530-025609-01, Revision 1

Security Threat Response Manager

Category Offense Investigation Guide

Release 2008.2

2

Networks Inc. in the United States and other countries. All other trademarks, service marks, registered trademarks, or registered service marks in this

document are the property of Juniper Networks or their respective owners. All specifications are subject to change without notice. Juniper Networks

assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves

the right to change, modify, transfer, or otherwise revise this publication without notice.

FCC Statement

The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A

digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the

equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and

used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential

area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following

information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it

is not installed in accordance with NetScreen’s installation instructions, it may cause interferencewith radio and television reception. This equipment has

been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These

specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that

interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be

determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:

Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/TV

technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.

Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.

Disclaimer

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET

THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE

SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.

Category Offense Investigation Guide

Release 2008.2

Revision History

June 2008—Revision 1

The information in this document is current as of the date listed in the revision history.

CONTENTS

ABOUT THIS GUIDE

Documentation Feedback 1

Requesting Support 1

1ACCESS OFFENSES

What is an Access Offense? 3

How do I Investigate an Access Offense? 4

How do I Tune an Access Offense? 7

2SIM AUDIT OFFENSES

What is SIM Audit? 9

How do I Investigate a SIM Audit Offense? 9

How do I Tune a SIM Audit Offense? 12

Tuning Using False Positive Function 12

Tuning Using Custom Rules Wizard 14

3AUTHENTICATION OFFENSES

What is an Authentication Offense? 17

How do I Investigate an Authentication Offense? 17

How do I Tune an Authentication Offense? 21

4CRE OFFENSES

What is a CRE Offense? 23

How do I Investigate a CRE Offense? 23

How do I Tune a CRE Offense? 26

5DENIAL OF SERVICE (DOS) OFFENSES

What is a DoS Offense? 27

What is a DoS Flood Attack? 27

What is a DoS Service Exploit? 28

How do I Investigate a DoS Offense? 28

How do I Tune a DoS Offense? 32

Tuning Using False Positive Function 32

Tuning Using Sentries 33

Tuning Using Custom Rules Wizard 33

How Can I Verify If STRM is Receiving Valid DoS Offenses? 34

6EXPLOIT OFFENSES

What is an Exploit Attack? 35

How do I Investigate an Exploit Offense 35

How do I Tune an Exploit Offenses? 39

How Can I Verify That STRM is Receiving Valid Exploit Offenses? 40

7MALWARE OFFENSES

What is Malware? 41

What is a Malware Offense? 41

How do I Investigate a Malware Offense? 42

How do I Tune a Malware Offense? 45

8NETWORK ANOMALIES OFFENSES

What is an Network Anomaly Offense? 47

Policy 47

Threshold 47

Anomaly 48

Behavior 48

How do I Investigate a Network Anomaly Offense 48

How do I Tune a Network Anomaly Offense? 50

9POLICY OFFENSES

What is a Policy Offense? 51

How do I Investigate a Policy Offense? 51

How do I Tune a Policy Offense? 54

Tuning Using False Positive Function 54

Tuning Using Custom Rules Wizard 55

How Can I Verify That STRM is Receiving Valid Offenses? 55

10 POTENTIAL EXPLOIT OFFENSES

What is a Potential Exploit Offense? 57

How do I Investigate a Potential Exploit Offense? 57

How do I Tune a Potential Exploit Offense? 59

11 RECONNAISSANCE OFFENSES

What is Reconnaissance? 61

What is Network Reconnaissance? 61

What is a Reconnaissances Offense? 61

How do I Investigate a Reconnaissance Offense? 62

How do I Tune a Reconnaissance Offense? 65

Tuning Using False Positive Function 65

Tuning Using Custom Rules Wizard 67

12 SUSPICIOUS ACTIVITY OFFENSES

What is a Suspicious Attack? 69

What is Suspicious Traffic? 69

What is a Suspicious Offense? 69

How do I Investigate Suspicious Offense 70

How do I Tune a Suspicious Offenses? 73

13 SYSTEM OFFENSES

What is a System Offense? 77

How do I Investigate a System Offense? 77

How do I Tune a System Offense? 80

How Can I Verify That STRM is Receiving Valid Offenses? 81

14 USER DEFINED OFFENSES

What is a User Defined Offense? 83

How do I Investigate a User Defined Offense? 83

How do I Tune a User Defined Offense? 86

Category Offense Investigation Guide

ABOUT THIS GUIDE

This preface provides the following guidelines for using the Category Offense

Investigation Guide:

•Documentation Feedback

•Requesting Support

Documentation

Feedback We encourage you to provide feedback, comments, and suggestions so that we

can improve the documentation. Send your comments to

techpubs-comments@juniper.net, or fill out the documentation feedback form at

http://www.juniper.net/techpubs/docbug/docbugreport.html. If you are using e-mail,

be sure to include the following information with your comments:

•Document name

•Document part number

•Page number

•Software release version

Requesting

Support Open a support case using the Case Management link at http://www.juniper.net/support/

or call 1-888-314-JTAC (from the United States, Canada, or Mexico) or

1-408-745-9500 (from elsewhere).

Offense Category Investigation Guide

1ACCESS OFFENSES

This chapter provides information on access offenses including:

•What is an Access Offense?

•How do I Investigate an Access Offense?

•How do I Tune an Access Offense?

What is an Access

Offense? Limiting access to your network and networked resources is an essential

component of any network security strategy. In most cases, this is accomplished

using firewalls. Monitoring the activity of the firewalls in your network is a massive

undertaking for most organizations since the amount of logs generated can be

overwhelming. STRM intelligently collects and analyzes firewall logs and then

automatically reports any abnormal and/or suspicious behavior.

STRM generates offenses based on access related behavior when a user is

attempting to gain illegal access to your network. By analyzing the firewall and

other intrusion prevention device logs, STRM determines when a particular IP

address has been denied access in a manner that requires investigation. STRM

can also detect suspicious failed access to the same destination as well as

multiple attempts across many distributed destinations.

Offense Category Investigation Guide

4ACCESS OFFENSES

How do I

Investigate an

Access Offense?

To investigate an access offense:

Step 1 Click the Offense Manager tab.

The Offense Manager window appears.

Step 2 Click By Category from the navigation menu.

The By Category view appears displaying high-level categories. The counts for

each category are accumulated from the values in the low-level categories.

Hint: Only low-level categories with associated offenses appear with an arrow.

You can click the arrow to view the associated low-level categories. If you wish to

view all categories, click Show Inactive Categories.

Step 3 To view additional low-level category information for the Access category, click the

arrow icon next to Access.

Step 4 Double-click any low-level category to view the list of associated offenses.

The list of offenses appear.

Altri manuali per SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV...

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali Juniper Software

Juniper

Juniper STRM 2008-2 - TECHNICAL NOTE CHANGING NETWORK SETTING... Manuale di installazione e funzionamento

Juniper

Juniper JUNOSE 11.2.X MULTICAST ROUTING Manuale utente

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - AQL EVENT AND FLOW QUERY CLI... Manuale utente

Juniper

Juniper STRM 2008.2 RELEASE NOTES Manuale di istruzioni

Juniper

Juniper JUNOSE 11.0.2 RELEASE NOTES Manuale di istruzioni

Juniper

Juniper RESIDENT CONSULTANT Manuale utente

Juniper

Juniper JUNOS 10.1 - CONFIGURATION GUIDE 1-2010 Manuale utente

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - SERVICE AVAILABILITY CONFIGURATION GUIDE... Manuale utente

Juniper

Juniper JUNOS SPACE SERVICE NOW Manuale utente

Juniper

Juniper JUNOSE 11.2.X BGP AND MPLS Manuale utente

Juniper

Juniper JUNOSE 11.1.X MULTICAST ROUTING Manuale utente

Juniper

Juniper JUNOSE SOFTWARE 11.0.X - COMMAND REFERENCE A TO M... Manuale di installazione

Juniper

Juniper JUNOSE 10.3.1 - S 3-19-2010 Manuale di istruzioni

Juniper

Juniper MWS1000 Istruzioni per l'installazione

Juniper

Juniper JUNOS OS 10.4 - XML API OPERATIONAL Manuale

Juniper

Juniper JUNOSE 10.0.3 - S 4-30-2010 Manuale di istruzioni

Juniper

Juniper JUNOS OS 10.4 - S REV 5 Manuale di istruzioni

Juniper

Juniper JUNOSE 11.1.X - COMMAND REFERENCE A TO M... Manuale di installazione

Juniper

Juniper JUNOSE SOFTWARE 11.2.X - SYSTEM EVENT LOGGING ... Manuale utente

Juniper

Juniper JUNOSE 11.1.X - COMMAND REFERENCE N TO Z... Manuale di installazione

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV... Manuale utente

Juniper

Juniper JUNOSE FOR E SERIES BROADBAND SERVICES ROUTERS - S... Manuale di istruzioni

Juniper

Juniper NETWORK AND SECURITY MANAGER 2010.3 - CONFIGURING INTRUSION DETECTION AND PREVENTION GUIDE... Manuale utente

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - POLICY MANAGEMENT CONFIGURATION GUIDE... Manuale utente

Manuali Software popolari di altre marche

COMPRO

COMPRO COMPROFM Manuale utente

Muratec

Muratec OFFICEBRIDGE ONLINE Manuale utente

Oracle

Oracle Contact Center Anywhere 8.1 Manuale utente

Adobe

Adobe 65007312 - Photoshop Lightroom Manuale

Avaya

Avaya NULL One-X for RIM Blackberry Manuale utente

HP ProLiant BL420c Manuale utente

PS Audio

PS Audio PowerPlay Manuale del proprietario

Brady

Brady LOCKOUT PRO 3.0 Manuale di servizio

Avaya

Avaya Interaction Center Manuale utente

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuale

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuale utente

Oracle

Oracle Application 9i Manuale utente

Acer

Acer RDM Manuale utente

Canon

Canon Vixia HF21 Manuale utente

Canon

Canon ZR950 Manuale utente

Samsung

Samsung Auto Backup Manuale utente

Polycom

Polycom Vortex EF2201 Istruzioni per l'installazione e il funzionamento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuale utente