Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT ADMINISTRATION GUIDE REV 1, Руководство пользователя

Страница: 240 / 246

STRM Users Guide
234 G
LOSSARY
end-system level. This sentry also monitors violations on usage-based policies,
which restrict or allow use of specific applications or network use. This sentry can
also specify situations that application usage is allowed.
sentry A sentry is an alerting function. It can monitor any number of views and generate
an alert when traffic in one of the monitored views meets the specified criteria.
severity Indicates the amount of threat an attacker poses in relation to how prepared the
target is for the attack. This value is mapped to an event category that is correlated
to the offense.
Simple Network
Management
Protocol (SNMP) A network management protocol used to monitor IP routers, other network
devices, and the networks to which they attach.
SNMP See Simple Network Management Protocol.
subnet A network subdivided into networks or subnets. When subnetting is used, the host
portion of the IP address is divided into a subnet number and a host number. Hosts
and routers identify the bits used for the network and subnet number through the
use of a subnet mask.
subnet mask A bit mask that is logically ANDed with the destination IP address of an IP packet
to determine the network address. A router routes packets using the network
address.
superflows Multiple flows with the same properties are combined into one flow to increase
processing by reducing storage.
System View Allows you to assign software components, such as a QFlow Collector, to systems
(managed hosts) in your deployment. The System View includes all managed
hosts in your deployment. A managed host is a system in your deployment that
has STRM software installed.
TACACS Terminal Access Controller Access Control System (TACACS) is an authentication
protocol that allows remote server access to forward a user’s logon password to an
authentication server to determine whether access can be allowed to a given
system. uses TCP.
TCP See Transmission Control Protocol.
TCP flags A type of marker that can be added to a packet to alert the system of abnormal
activity. Only a few specific combinations of flags are valid and typical, in normal
traffic. Abnormal combinations of flags often indicate an attack or an abnormal
network condition.