background image

Release 2008.2

14

38

TopLayerIPS

TopLayer IPS

39

Generic

Generic DSM

40

Tripwire

Tripwire

41

ASA

Cisco ASA

42

Niksun

Niksun

43

Sidewinder

Secure Computing - Sidewinder

45

NetscreenNSM

Netscreen NSM

46

WebProxy

Squid WebProxy

47

IpAngel

Lucid IpAngel

48

OracleDbAudit

Oracle Database Audit Records

49

BigIP

F5 Networks BigIP

50

SolarisDhcpd

Solaris DHCP Transaction Logs

55

ArrayVPN

Array VPN

56

CiscoCatOS

Cisco CatOS

57

ProFTPD

ProFTPD server

58

LinuxDHCPServer

Linux DHCP Server

59

InfranetController

Juniper Infranet Controller

60

PDSN

Sprint PoC PDSN

61

RNC

Sprint PoC RNC

62

BTS

Sprint PoC BTS

63

ACS

Cisco ACS

64

JuniperRouter

Juniper Router

65

Sprint

Sprint PoC

66

CallManager

Cisco Call Manager

67

GenericLog

Generic Log DSM+C46

68

Nseries

Enterasys N Series Router/Switch

70

ExtremeWare

ExtremeWare 7.7

71

Sidewinder

Secure Computing - Sidewinder

73

FortiGuard

Fortinet FortiGuard

75

SymantecAV

Symantec Anti Virus

78

SonicWall

SonicWall Firewall

79

Vericept

Vericept Content 360

80

WindowsAgent

Q1 Windows Agent Syslog

82

SymantecFirewall

Symantec Firewall

83

JuniperSBR

Juniper Steel-Belted Radius

85

IBM AIX

IBM AIX 5L Operating System

Table 6   

Device Type ID Numbers  (continued)

ID

Device

Description

Содержание NETWORKS STRM - TECHNICAL NOTE REV 6-2008

Страница 1: ...to various device types Using an extension document you can resolve parsing issues such as Fixing an event that has missing or incorrect fields for example if the username is not being parsed Completi...

Страница 2: ...ch groups may appear in the extension document Table 1 Pattern Parameters Parameter Description id Required Specify a regular string that is unique within the extension document case insensitive Optio...

Страница 3: ...st be a valid device type ID represented as an integer A list of device type IDs is presented in Table 6 If not specified this parameter defaults to the device type of the device to which the extensio...

Страница 4: ...nted with a straight group capture You can combine multiple groups together with extra text to form a value This parameter enables that behavior This parameter changes the meaning of the capture group...

Страница 5: ...ource MAC address for the message SourcePortPreNAT Specify the source port for the message before NAT occurs SourcePortPostNAT Specify the source port for the message after NAT occurs DestinationIp Sp...

Страница 6: ...port based protocols UserName Specify the user name associated with the event HostName Specify the host name associated with the event This field is usually only associated with identity events GroupN...

Страница 7: ...ation on creating extension documents including Writing a Complete Extension Document Uploading Extension Documents Solving Specific Parsing Issues send identity Specifies the sending of identity chan...

Страница 8: ...ld could use the exact same pattern in this case this may not be true in all FWSM events xml version 1 0 encoding UTF 8 device extension xmlns event_parsing device_extension pattern id EventNameFWSM x...

Страница 9: ...l The FWSM uses the Cisco Pix QID and therefore includes the device type id override 6 parameter in the match group the Pix firewall s device type ID is 6 see Table 6 If the QID information is not spe...

Страница 10: ...ce of TCP UDP ICMP or GRE the pattern is marked with the case insensitive parameter so that any occurrence matches Note You must search for the protocol when writing extension documents as STRM may no...

Страница 11: ...The following is an example of a straight substitution that parses the source IP address and then overrides the result and sets the IP address to 10 100 100 100 ignoring the IP address in the payload...

Страница 12: ...llowing example is similar to the above single event example except that this example matches all event codes starting with 7 and followed by one to five digits pattern id EventNameId xmlns CDATA 7 d...

Страница 13: ...x login messages 12 WindowsAuthServer Windows Security Event Log 13 IIS Windows IIS Webserver logs 14 Iptables Linux iptables Firewall 15 Proventia ISS Proventia Device 16 Classify Q1Labs Classify Eng...

Страница 14: ...niper Infranet Controller 60 PDSN Sprint PoC PDSN 61 RNC Sprint PoC RNC 62 BTS Sprint PoC BTS 63 ACS Cisco ACS 64 JuniperRouter Juniper Router 65 Sprint Sprint PoC 66 CallManager Cisco Call Manager 67...

Страница 15: ...Nortel Switched Firewall 6000 105 Q1Labs QRadar Q1Labs QRadar 106 3Com 8800 Series Switch 3Com 8800 Series Switch 107 Nortel VPN Gateway Nortel VPN Gateway 108 NortelTPS Nortel Threat Protection Intru...

Страница 16: ...trademarks or registered service marks in this document are the property of Juniper Networks or their respective owners All specifications are subject to change without notice Juniper Networks assumes...

Отзывы: