Juniper SECURITY THREAT RESPONSE MANAGER - SOFTWARE INSTALLATION REV 1, Руководство по установке

Страница: 11 / 32

STRM Installation Guide
Identifying Security Monitoring Devices and Flow Data Sources 9
Identifying Security
Monitoring Devices
and Flow Data
Sources
STRM can collect and correlate events received from external sources such as
security equipment (for example, firewalls, VPNs, or IDSs) and host or application
security logs, such as, window logs. Device Support Modules (DSMs) and Flow
Collectors allows you to integrate STRM with this external data.
STRM automatically discovers sensor devices that are sending syslog messages
to an Event Collector. Any sensor devices that are automatically discovered by
STRM appear in the Sensor Devices window within the STRM Administration
Console. Once auto discovery is complete, you should disable the Auto Detection
Enabled option in the Event Collector configuration. For more information, see
Chapter 4 Using the Deployment Editor of the
STRM Administration Guide .
Non-syslog based information sources must be added to your deployment
manually. For more information, see the
Managing Sensor Devices Guide . For
each device you wish to add to your deployment, record the device in Table 1-2 .
Where:
•
Link Speed & Type indicates the maximum network link (in Kbps) for firewall,
router, and VPN devices. Record the primary application of the host system, for
example, e-mail, anit-virus, domain controller, or a workstation.
•
Msg Level indicates the message level you wish to log. For example, critical,
informational, debug.
•
No. of Users indicates the maximum number of hosts/users using or being
served by tis device.
•
Network Location indicates whether this device is located on the Internet
DMZ, Intranet, or Extranet DMZ.
•
Geographic Location indicates if the devices is located on the same LAN as
STRM or sending logs over the WAN identified in the Link Speed & Type
column.
• Credibility indicates the integrity of an event or offense as determined by the
credibility rating from source devices. Credibility increases as the multiple
sources report the same event.
Table 1-2 Devices
Device
Type
QTY
Product
Name/
Version Link
Speed
& Type
Msg
Level
Avg Log
Rate
(Event/Sec)
No. of
Users Network
Location Geographic
Location Credibility
(0 to 10)