background image

Release 2008.2

Device Type IDs

15

86

metainfo Meta IP

metainfo Meta IP

87

SymantecSystemCenter

Symantec System Center JDBC/WinAgent

90

Cisco ACS

Cisco ACS

91

Sentinel

Enterasys Sentinel

92

CounterACT

Forescount CounterACt

93

McAfee ePO

McAfee ePolicy Orchestrator

94

Cisco CSA-syslog

Cisco CSA using syslog

95

Cisco NAC

Cisco NAC Appliance

96

TippingPointx505

3com Tippingpoint x5 series

97

MicrosoftDHCP

Microsoft DHCP server

98

MicrosoftIAS

Microsoft IAS server

99

MicrosoftExchange

Microsoft Exchange server

100

TrendISVW

Trend Interscan Virus wall

101

MsSQL

Microsoft SQL Server

102

AppleOSX

Apple OSX system/fw events

103

Bluecoat

Bluecoat SG Appliance

104

Firewall6000

Nortel Switched Firewall 6000

105

Q1Labs QRadar

Q1Labs QRadar

106

3Com 8800 Series Switch  3Com 8800 Series Switch 

107

Nortel VPN Gateway

Nortel VPN Gateway

108

NortelTPS

Nortel Threat Protection Intrusion Sensor

109

Vis Host Events

Vis New Host, Port, Vuln Notifications

110

NortelNAS

Nortel Application Switch

111

JuniperDX

Juniper DX accelerator 

112

SNAREReflector

SNARE Reflector

113

Cisco 12000 Series

Cisco 12000 Series

114

Cisco 6500 Series

Cisco 6500 Series

115

Cisco 7600 Series

Cisco 7600 Series

116

Cisco CRS Series

Cisco CRS Series

117

Cisco ISR Series

Cisco ISR Series

118

Juniper M Series

Juniper M Series

119

Third Brigade

Third Brigade Deep Security Manager

120

Firewall5100

Nortel Switched Firewall 5100

121

JunOS

JunOS

122

Juniper MX Series

Juniper MX Series

123

Juniper T Series

Juniper T Series

Table 6   

Device Type ID Numbers  (continued)

ID

Device

Description

Содержание NETWORKS STRM - TECHNICAL NOTE REV 6-2008

Страница 1: ...to various device types Using an extension document you can resolve parsing issues such as Fixing an event that has missing or incorrect fields for example if the username is not being parsed Completi...

Страница 2: ...ch groups may appear in the extension document Table 1 Pattern Parameters Parameter Description id Required Specify a regular string that is unique within the extension document case insensitive Optio...

Страница 3: ...st be a valid device type ID represented as an integer A list of device type IDs is presented in Table 6 If not specified this parameter defaults to the device type of the device to which the extensio...

Страница 4: ...nted with a straight group capture You can combine multiple groups together with extra text to form a value This parameter enables that behavior This parameter changes the meaning of the capture group...

Страница 5: ...ource MAC address for the message SourcePortPreNAT Specify the source port for the message before NAT occurs SourcePortPostNAT Specify the source port for the message after NAT occurs DestinationIp Sp...

Страница 6: ...port based protocols UserName Specify the user name associated with the event HostName Specify the host name associated with the event This field is usually only associated with identity events GroupN...

Страница 7: ...ation on creating extension documents including Writing a Complete Extension Document Uploading Extension Documents Solving Specific Parsing Issues send identity Specifies the sending of identity chan...

Страница 8: ...ld could use the exact same pattern in this case this may not be true in all FWSM events xml version 1 0 encoding UTF 8 device extension xmlns event_parsing device_extension pattern id EventNameFWSM x...

Страница 9: ...l The FWSM uses the Cisco Pix QID and therefore includes the device type id override 6 parameter in the match group the Pix firewall s device type ID is 6 see Table 6 If the QID information is not spe...

Страница 10: ...ce of TCP UDP ICMP or GRE the pattern is marked with the case insensitive parameter so that any occurrence matches Note You must search for the protocol when writing extension documents as STRM may no...

Страница 11: ...The following is an example of a straight substitution that parses the source IP address and then overrides the result and sets the IP address to 10 100 100 100 ignoring the IP address in the payload...

Страница 12: ...llowing example is similar to the above single event example except that this example matches all event codes starting with 7 and followed by one to five digits pattern id EventNameId xmlns CDATA 7 d...

Страница 13: ...x login messages 12 WindowsAuthServer Windows Security Event Log 13 IIS Windows IIS Webserver logs 14 Iptables Linux iptables Firewall 15 Proventia ISS Proventia Device 16 Classify Q1Labs Classify Eng...

Страница 14: ...niper Infranet Controller 60 PDSN Sprint PoC PDSN 61 RNC Sprint PoC RNC 62 BTS Sprint PoC BTS 63 ACS Cisco ACS 64 JuniperRouter Juniper Router 65 Sprint Sprint PoC 66 CallManager Cisco Call Manager 67...

Страница 15: ...Nortel Switched Firewall 6000 105 Q1Labs QRadar Q1Labs QRadar 106 3Com 8800 Series Switch 3Com 8800 Series Switch 107 Nortel VPN Gateway Nortel VPN Gateway 108 NortelTPS Nortel Threat Protection Intru...

Страница 16: ...trademarks or registered service marks in this document are the property of Juniper Networks or their respective owners All specifications are subject to change without notice Juniper Networks assumes...

Отзывы: