Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT ADMINISTRATION GUIDE REV 1, Руководство пользователя

Страница: 234 / 246

STRM Users Guide
228 G
LOSSARY
external data views Require input from external products, such as an IDS engine (for example,
SNORT) or firewalls (for example, Cisco PIX or Checkpoint Firewall). These
external products provide information to STRM on specified IP addresses that are
correlated to the flows responsible. STRM monitors flows between these systems
and tags traffic between the hosts for a configured period of time.
event Record from a device that describes an action on a network or host.
Event Collector Collects security events from various types of security devices in your network.
The Event Collector gathers events from local, remote, and device sources. The
Event Collector then normalizes the events and sends the information to the Event
Processor.
Event Processor Processes flows collected from one or more Event Collector(s). The events are
bundled once again to conserve network usage. Once received, the Event
Processor correlates the information from STRM and distributed to the appropriate
area, depending on the type of event.
flow Communication session between two host. Describes how traffic is communicated,
what was communicated (if content capture option has been selected), and
includes such details as when, who, how much, protocols, priorities, options, etc.
flow data Specific properties of a flow including: IP addresses, ports, protocol, bytes,
packets, flags, direction, application ID, and payload data (optional).
flow logs Record of flows that enables the system to understand the context of a particular
transmission over the network. Flows are stored in flow logs.
Flow Processor Collects and consolidates data from one or more QFlow Collector(s). Functions
include removing duplicate flows and creating
superflows (aggregate flows) before
the flows reach the Classification Engine.
flow sources Source of flows that the QFlow Collector receives. Using the deployment editor,
you can add internal and external flow sources from either the System or Flow
Views in the deployment editor.
flow type view Allows you to view network activity according to flow types. This depends on the
ratio of incoming activity to outgoing activity.
Flow View Allows you to create a view that outlines how flows are processed in your
deployment by allocating and connecting flow-based components. For example,
connecting a QFlow Collector to a Flow Processor.
Fully Qualified
Domain Name
(FQDN) The portion of an Internet Uniform Resource Locator (URL) that fully identifies the
server program that an Internet request is addressed to.