background image

Release 2008.2

Device Type IDs

13

Device Type IDs

Table 6

 lists the Device Type IDs that can be used in a 

match-group

 statement:

.

Table 6   

Device Type ID Numbers  

ID

Device

Description

2

Snort 

Snort Open Source IDS 

3

CheckPoint 

CheckPoint Firewall-1 Devices via syslog 

4

GenericFirewall   

Configurable Firewall Filter 

5

NetScreenFirewall 

NetScreen Firewall Appliance 

6

Pix 

Cisco PIX Firewall                         

7

GenericAuthServer 

Configurable Authentication message filter 

8

SOAP 

Webservice-based messages

9

Dragon 

Enterasys Dragon IDS 

10

Apache 

Open Source Apache Webserver 

11

LinuxServer 

Linux login messages 

12

WindowsAuthServer 

Windows Security Event Log 

13

IIS 

Windows IIS Webserver logs 

14

Iptables 

Linux iptables Firewall 

15

Proventia 

ISS Proventia Device 

16

Classify 

Q1Labs Classify Engine 

17

NetScreenIDP 

NetScreen IDP 

18

EventCRE 

Event CRE 

19

UnityOne 

Tipping Point UnityOne 

20

IOS 

Cisco IOS 

21

Contivity 

Nortel Contivity VPN Switch 

22

ARN 

Nortel BayRS 15.x 

23

VpnConcentrator   

VPN 3000 Concentrator 

24

Solaris 

Solaris Login Messages 

25

IntruShield 

McAfee IntruShield Network IPS Appliance   

26

CSA 

Cisco CSA 

28

Enterasys 

Enterasys Matrix E1 Switch 

29

Sendmail

Solaris Sendmail

30

IDS 

Cisco IDS 

31

Cisco FWSM

Cisco FWSM

33

SiteProtector 

ISS SiteProtector 

35

Cyberguard 

Cyberguard 

36

JuniperSA

Juniper Secure Access 

37

Contivityv2

Nortel Contivity VPN Switch 

Содержание NETWORKS STRM - TECHNICAL NOTE REV 6-2008

Страница 1: ...to various device types Using an extension document you can resolve parsing issues such as Fixing an event that has missing or incorrect fields for example if the username is not being parsed Completi...

Страница 2: ...ch groups may appear in the extension document Table 1 Pattern Parameters Parameter Description id Required Specify a regular string that is unique within the extension document case insensitive Optio...

Страница 3: ...st be a valid device type ID represented as an integer A list of device type IDs is presented in Table 6 If not specified this parameter defaults to the device type of the device to which the extensio...

Страница 4: ...nted with a straight group capture You can combine multiple groups together with extra text to form a value This parameter enables that behavior This parameter changes the meaning of the capture group...

Страница 5: ...ource MAC address for the message SourcePortPreNAT Specify the source port for the message before NAT occurs SourcePortPostNAT Specify the source port for the message after NAT occurs DestinationIp Sp...

Страница 6: ...port based protocols UserName Specify the user name associated with the event HostName Specify the host name associated with the event This field is usually only associated with identity events GroupN...

Страница 7: ...ation on creating extension documents including Writing a Complete Extension Document Uploading Extension Documents Solving Specific Parsing Issues send identity Specifies the sending of identity chan...

Страница 8: ...ld could use the exact same pattern in this case this may not be true in all FWSM events xml version 1 0 encoding UTF 8 device extension xmlns event_parsing device_extension pattern id EventNameFWSM x...

Страница 9: ...l The FWSM uses the Cisco Pix QID and therefore includes the device type id override 6 parameter in the match group the Pix firewall s device type ID is 6 see Table 6 If the QID information is not spe...

Страница 10: ...ce of TCP UDP ICMP or GRE the pattern is marked with the case insensitive parameter so that any occurrence matches Note You must search for the protocol when writing extension documents as STRM may no...

Страница 11: ...The following is an example of a straight substitution that parses the source IP address and then overrides the result and sets the IP address to 10 100 100 100 ignoring the IP address in the payload...

Страница 12: ...llowing example is similar to the above single event example except that this example matches all event codes starting with 7 and followed by one to five digits pattern id EventNameId xmlns CDATA 7 d...

Страница 13: ...x login messages 12 WindowsAuthServer Windows Security Event Log 13 IIS Windows IIS Webserver logs 14 Iptables Linux iptables Firewall 15 Proventia ISS Proventia Device 16 Classify Q1Labs Classify Eng...

Страница 14: ...niper Infranet Controller 60 PDSN Sprint PoC PDSN 61 RNC Sprint PoC RNC 62 BTS Sprint PoC BTS 63 ACS Cisco ACS 64 JuniperRouter Juniper Router 65 Sprint Sprint PoC 66 CallManager Cisco Call Manager 67...

Страница 15: ...Nortel Switched Firewall 6000 105 Q1Labs QRadar Q1Labs QRadar 106 3Com 8800 Series Switch 3Com 8800 Series Switch 107 Nortel VPN Gateway Nortel VPN Gateway 108 NortelTPS Nortel Threat Protection Intru...

Страница 16: ...trademarks or registered service marks in this document are the property of Juniper Networks or their respective owners All specifications are subject to change without notice Juniper Networks assumes...

Отзывы: