Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT ADMINISTRATION GUIDE REV 1, Руководство пользователя

Страница: 48 / 246

STRM Users Guide
42 M
ANAGING
S
ENTRIES
A Security/Policy sentry is useful for detecting undesirable policy issues such as
remote access to client networks, Peer-to-Peer (P2P)/Instant Messaging (IM) or
other misuse applications, or inappropriate use of business applications.
Threshold
A Threshold sentry monitors your deployment for activity that exceeds the
configured threshold of the sentry. STRM monitors relevant network objects and
identifies whenever a threshold is exceeded. Thresholds can be based on any
data collected by STRM, not just packet count or bandwidth. For example, if you
create a sentry indicating that no more than 220 clients can log into the server
between 8 am and 5 pm, an alert generates if the 221st client attempts to login.
A Threshold sentry is useful for monitoring utilized bandwidth, monitoring above
noise for specific activity on your network, or monitoring for device failure.
Custom
You can create a custom sentry to your network has specific monitoring
requirements. A custom sentry can monitor for any combination of properties you
customer requires.
Viewing Sentries
Using the Network Surveillance interface, you can view any sentries you created or
another user has configured to share with you for the area of the network you are
currently viewing.
To view sentries:
Step 1
Click the Network Surveillance tab.
The Network Surveillance interface appears.
Step 2
Navigate to the area of the network for which you wish to view sentries.
Note: To view all sentries, see the STRM Administration Guide.
Step 3
Below the graph, click View Sentries .
The Sentry List window appears.