Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT ADMINISTRATION GUIDE REV 1, Руководство пользователя

Страница: 239 / 246

STRM Users Guide
G
LOSSARY
233
QID STRM Identifier. A mapping of a single event of an external device to a Q1 Labs
unique identifier.
STRM Request
Language (QRL) Specifies what information is queried in your graph and defines how it appears.
The QRL allows you to identify and remember a specific location and view on a
network. A QRL corresponds to one or more graphs.
STRM Time The right corner of the STRM interface displays STRM time, which is the time of
the STRM Console. This is the time that determines the time of events and
offenses.
QRL See STRM Request Language.
refresh timer Dashboard features a dynamic status bar that displays the amount of time until
STRM automatically refreshes the current network activity data; built-in refresh can
be manually refreshed at any time.
relevance Relevance determines the significance of an event, category or offense.
remote network view Allows you to define remote networks according to their name or location. Remote
network views allow you to verify the effectiveness of the firewall and determine
service abuse or targeting for your entire STRM deployment.
remote services view Using a remote IP address range, remote services views allow you to determine
how network resources are being used. By default, this view is disabled.
reports A function that creates executive or operational level charting representations of
network activity based on time, attackers, offenses, security, and events.
report interval A configurable time interval at which the Flow Processor must send all captured
flow data to the Console.
Resolver A Resolver executes assigned Resolver Actions.
Resolver Action A Resolver Action blocks host(s) affecting your network. A Resolver Action can
have several Resolvers assigned as primary or reserve Resolvers.
Resolver Agent A Resolver Agent is a collection of Resolvers that you wish to deploy a group.
Resolver Type Specifies the type of Resolver. The options are: TCP Reset, ARP Redirect, Cisco,
Cisco PIX, NetScreen, and Checkpoint Firewall Resolver.
rule Collection of conditions and consequent actions. You can configure rules that
allow STRM to capture and respond to specific event sequences. security/policy
sentry
Monitors your deployment for security/policy violations. A Security/Policy sentry
monitors your network for policy compliance at the network, application, or