Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 831 / 1026

the Log Investigator automatically clears the session, requiring you to create a new time
filter.
For example, on Friday afternoon, you want to investigate attacks received by your
network in the last seven hours. Configure the time period as shown in Figure 111 on
page 781.
Figure 111: Configure Time Period Filter
On Monday morning, you want to investigate attacks received by your network during
the last work week. If Monday’s data is 5/17/04, you configure the time period as show
in Figure 112 on page 781.
Figure 112: Changing Time Period Filter
Configuring Axes
The Left Axis is the independent axis because it is the first data collected. The Top Axis
is the dependent axis because it uses the Left Axis data as the data set.
The dependency occurs because the Log Investigator collects data that matches the
Left Axis setting first; this data represents the data set for the entire log entry matrix. By
default, the Left Axis is set to the data type Top Sources. After the Left Axis data set has
been determined, the Log Investigator searches that data set for data that matches the
Top Axis setting. By default, the Top Axis is set to the data type Top Destinations.
Because the Left Axis setting controls the initial data set, it is the most important axis
setting. Typically, you should set the Left Axis to the data type you most want to
investigate.
Setting the Data Type
You can change the data type for each axis. The data type defines the type of information
that the Log Investigator attempts to locate in your log entries. For either axis, you can
set the following data types:
•
Top Sources —The IP address that generated the event.
•
Top Destination s—The IP address that received the event.
• Top Subcategories —The attack subcategory detected in the event.
• Top Destination Ports —The port numbers on the Destination device that received the
event. The port number can help you identify the service used in the event.
781 Copyright © 2010, Juniper Networks, Inc.
Chapter 19: Logging