Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT ADMINISTRATION GUIDE REV... Manuale di istruzioni

Juniper Networks, Inc.

1194 North Mathilda Avenue

Sunnyvale, CA 94089

USA

408-745-2000

www.juniper.net

Part Number: 530-027298-01, Revision 1

Security Threat Response Manager

STRM Log Management Administration

Guide

Release 2008.2 R2

2

Networks Inc. in the United States and other countries. All other trademarks, service marks, registered trademarks, or registered service marks in this

document are the property of Juniper Networks or their respective owners. All specifications are subject to change without notice. Juniper Networks

assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves

the right to change, modify, transfer, or otherwise revise this publication without notice.

FCC Statement

The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A

digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the

equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and

used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential

area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following

information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it

is not installed in accordance with NetScreen’s installation instructions, it may cause interference with radio and television reception. This equipment has

been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These

specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that

interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be

determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:

Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/TV

technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.

Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.

Disclaimer

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET

THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE

SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.

STRM Log Management Administration Guide

Release 2008.2 R2

Revision History

September 2008—Revision 1

The information in this document is current as of the date listed in the revision history.

CONTENTS

ABOUT THIS GUIDE

Audience 1

Conventions 1

Technical Documentation 1

Contacting Customer Support 2

1OVERVIEW

About the Interface 3

Accessing the Administration Console 4

Using the Interface 4

Deploying Changes 5

Viewing STRM Log Management Audit Logs 5

Logged Actions 6

Viewing the Log File 7

2MANAGING USERS

Managing Roles 9

Creating a Role 9

Editing a Role 11

Managing User Accounts 12

Creating a User Account 12

Editing a User Account 13

Disabling a User Account 14

Authenticating Users 15

3SETTING UPSTRM LOG MANAGEMENT

Managing Your License Keys 19

Updating your License Key 20

Exporting Your License Key Information 21

Creating Your Network Hierarchy 22

Considerations 22

Defining Your Network Hierarchy 23

Scheduling Automatic Updates 26

Configuring System Settings 27

Configuring System Notifications 31

Configuring the Console Settings 33

Starting and Stopping STRM Log Management 35

Accessing the Embedded SNMP Agent 35

Configuring Access Settings 36

Configuring Firewall Access 36

Updating Your Host Set-up 38

Configuring Interface Roles 39

Changing Passwords 40

Updating System Time 40

4MANAGING BACKUP AND RECOVERY

Managing Backup Archives 45

Viewing Back Up Archives 45

Importing an Archive 46

Deleting a Backup Archive 47

Backing Up Your Information 48

Scheduling Your Backup 48

Initiating a Backup 49

Restoring Your Configuration Information 50

5USING THE DEPLOYMENT EDITOR

About the Deployment Editor 54

Accessing the Deployment Editor 55

Using the Editor 55

Creating Your Deployment 57

Before you Begin 57

Editing Deployment Editor Preferences 58

Building Your Event View 58

Adding Components 59

Connecting Components 60

Forwarding Normalized Events 61

Renaming Components 63

Managing Your System View 63

Setting Up Managed Hosts 64

Using NAT with STRM Log Management 68

Configuring a Managed Host 72

Assigning a Component to a Host 72

Configuring Host Context 73

Configuring STRM Log Management Components 76

Configuring an Event Collector 76

Configuring an Event Processor 77

6FORWARDING SYSLOG DATA

Adding a Syslog Destination 79

Editing a Syslog Destination 80

Delete a Syslog Destination 81

AQ1 LABS MIB

INDEX

STRM Log Management Administration Guide

ABOUT THIS GUIDE

The STRM Log Management Administration Guide provides you with information

for managing STRM Log Management functionality requiring administrative

access.

Audience This guide is intended for the system administrator responsible for setting up

STRM Log Management in your network. This guide assumes that you have

STRM Log Management administrative access and a knowledge of your corporate

network and networking technologies.

Conventions Table 1 lists conventions that are used throughout this guide.

Technical

Documentation

You can access technical documentation, technical notes, and release notes

directly from the Juniper Networks support web site at https://juniper.net/support.

Once you access the Juniper Networks support web site, locate the product and

software release for which you require documentation.

Your comments are important to us. Please send your e-mail comments about this

guide or any of the Juniper Networks documentation to:

documentation@juniper.net.

Include the following information with your comments:

•Document title

Table 1 Icons

Icon Type Description

Information note Information that describes important features or

instructions.

Caution Information that alerts you to potential loss of

data or potential damage to an application,

system, device, or network.

Warning Information that alerts you to potential personal

injury.

STRM Log Management Administration Guide

2ABOUT THIS GUIDE

•Page number

Contacting

Customer Support

To help you resolve any issues that you may encounter when installing or

maintaining STRM Log Management, you can contact Customer Support as

follows:

•Log a support request 24/7: https://juniper.net/support/

For access to the Juniper Networks support web site, please contact Customer

Support.

•Access Juniper Networks support and Self-Service support using e-mail:

support@juniper.net

•Telephone assistance: 1-800-638-8296.

QSTRM Log Management Administration Guide

1OVERVIEW

This chapter provides an overview of the STRM Log Management Administration

Console and STRM Log Management administrative functionality including:

•About the Interface

•Accessing the Administration Console

•Using the Interface

•Deploying Changes

•Viewing STRM Log Management Audit Logs

About the Interface You must have administrative privileges to access the Administration Console. The

STRM Log Management Administration Console provides access to following

administrative functionality:

•Manage users. See Chapter 2 Managing Users.

•Manage STRM Log Management. See Chapter 3 Setting Up STRM Log

Management.

•Backup and recover your data. See Chapter 4 Managing Backup and

Recovery.

•Manage your deployment views. See Chapter 5 Using the Deployment Editor.

•Configure syslog forwarding. See Chapter 6 Forwarding Syslog Data.

All configuration updates using the Administration Console are saved to a staging

area. Once all changes are complete, you can deploy the configuration changes or

all configuration settings to the remainder of your deployment.

QSTRM Log Management Administration Guide

4OVERVIEW

Accessing the

Administration

Console

You can access the STRM Log Management Administration Console through the

main STRM Log Management interface. Also, you can create a shortcut on your

desktop that allows you to access the Administration Console directly.

To access the Administration Console, click Config in the main STRM Log

Management interface. The Administration Console appears.

Using the Interface The Administration Console provides several tab and menu options that allow you

to configure STRM Log Management including:

•System Configuration - Provides access to administrative functionality, such

as, user management, automatic updates, license key, network hierarchy,

system settings, system thresholds, backup and recovery and Console

configuration.

•SIM Configuration - Provides access to sensor device management and

syslog forwarding.

The Administration Console also includes several menu options including:

Table 1-1 Administrative Console Menu Options

Menu Option Sub-Menu Description

File Close Closes the Administration Console.

Configurations Deployment Editor Opens the deployment editor

interface.

Deploy configuration

changes

Deploys any configuration changes

from the current session to your

deployment.

Deploy All Deploys all configuration settings to

your deployment.

System STRM Start Starts the STRM Log Management

application.

Altri manuali per SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT ADMINISTRATION GUIDE REV...

Indice

Altri manuali Juniper Software

Juniper

Juniper JUNOS 10.1 - S REV 4 Manuale di istruzioni

Juniper

Juniper JUNOSE 11.1.X - QUALITY OF SERVICE CONFIGURATION GUIDE... Manuale utente

Juniper

Juniper BGP - CONFIGURATION GUIDE V 11.1.X Manuale utente

Juniper

Juniper NETWORKS STRM - TECHNICAL NOTE REV 6-2008 Manuale utente

Juniper

Juniper MEDIA FLOW CONTROLLER 2.0.4 - Manuale utente

Juniper

Juniper JUNOSE 10.3.1 - S 3-19-2010 Manuale di istruzioni

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV... Manuale di istruzioni

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 -... Manuale utente

Juniper

Juniper IP SERVICES - CONFIGURATION GUIDE V 11.1.X Manuale utente

Juniper

Juniper JUNOSE 11.1.0 - REV 4-29-2010 Manuale utente

Juniper

Juniper RESIDENT ENGINEER Manuale utente

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - COMMAND REFERENCE N TO Z... Manuale di installazione

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - MANAGING VULNERABILITY ASSESSMENT... Manuale utente

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - IP-IPV6-IGP CONFIGURATION GUIDE... Manuale utente

Juniper

Juniper JUNOSE 11.0.X MULTICAST ROUTING Manuale utente

Juniper

Juniper STRM 2008-2 - TECHNICAL NOTE CHANGING NETWORK SETTING... Manuale di istruzioni

Juniper

Juniper JUNOS PUS MOBILE SECURITY SUITE Manuale utente

Juniper

Juniper JUNOS OS 10.4 - XML API OPERATIONAL Manuale

Juniper

Juniper JUNOS SPACE 2.0 - RELEASE NOTES Manuale di istruzioni

Juniper

Juniper STRM 2008-2 - TECHNICAL NOTE CHANGING NETWORK SETTING... Manuale di installazione e funzionamento

Juniper

Juniper NETWORK AND SECURITY MANAGER NSMXPRESS SERIES II - ... Manuale utente

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - POLICY MANAGEMENT CONFIGURATION GUIDE... Manuale utente

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.0.X - BGP AND MPLS CONFIGURATION GUIDE... Manuale utente

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER - LOG MANAGEMENT INSTALLATION REV... Manuale utente

Manuali Software popolari di altre marche

COMPRO

COMPRO COMPROFM Manuale utente

Muratec

Muratec OFFICEBRIDGE ONLINE Manuale utente

Oracle

Oracle Contact Center Anywhere 8.1 Manuale utente

Adobe

Adobe 65007312 - Photoshop Lightroom Manuale

Avaya

Avaya NULL One-X for RIM Blackberry Manuale utente

HP ProLiant BL420c Manuale utente

PS Audio

PS Audio PowerPlay Manuale del proprietario

Brady

Brady LOCKOUT PRO 3.0 Manuale di servizio

Avaya

Avaya Interaction Center Manuale utente

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuale

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuale utente

Oracle

Oracle Application 9i Manuale utente

Acer

Acer RDM Manuale utente

Canon

Canon Vixia HF21 Manuale utente

Canon

Canon ZR950 Manuale utente

Samsung

Samsung Auto Backup Manuale utente

Polycom

Polycom Vortex EF2201 Istruzioni per l'installazione e il funzionamento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuale utente