Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT ADMINISTRATION GUIDE REV 1, Manual

Page: 54 / 246

STRM Users Guide
48 M
ANAGING
S
ENTRIES
b
If you did not select the auto learn option:
Note: For detailed information on high-level and low-level categories, see the
Event Category Correlation Reference Guide.
Step 10
Click Next .
Step 11
Review the sentry details. Click Finish .
Trigger Trigger Script Using the drop-down list box, specify the action you
wish the sentry engine to perform. The options include:
•
Trigger Script - Specify if you wish this sentry to
use the following:
SNMP traps - Sentry engine sends an SNMP Trap
notification.
Block IPs - Sentry engine blocks specific IP
addresses.
•
Parameters - Specify the parameters required to
trigger either the SNMP trap or to block IP
addresses. Enter parameters in the following
format:
If you are using SNMP version 1:
1 <community> <IP address>
1.3.6.1.4.1. 20212
If you are using SNMP version 2:
2 <community> <IP address>
1.3.6.1.4.1.20212.200.3
Note: These default scripts need to be customized for
proper use in your environment. To edit the script, use
SSH to login to your STRM Console and edit the
scripts in the /opt/qradar/triggerbin directory. For
assistance, contact your local administrator.
Syslog Select the check box if you wish to save the sentry
event log file to the syslog server.
Table 4-5 Security/Policy Sentry Response Parameters
Parameter Action
High-Level Category Using the drop-down list box, specify the high-level event
category.
Low-Level Category Using the drop-down list box, specify the low-level event
category.
Ensure the dispatched
event is part of an offense
Select the check box if you wish this event to be included
with other events to create an offense.
Address to mark as the
target
Using the drop-down list box, identify if you wish the
destination or source IP address to be used as the target.
Table 4-4 Sentry Response Parameters (continued)
Parameter Sub-Parameter Action