Configuring Network Honeypot Rulebase Rules (Nsm Procedure) - Juniper NETWORK AND SECURITY MANAGER 2010.3 - CONFIGURING INTRUSION DETECTION AND PREVENTION GUIDE REV1 Manual

Configuring Intrusion Detection and Prevention Devices Guide
Related Topics

Configuring Network Honeypot Rulebase Rules (NSM Procedure)

54
Table 32: Traffic Anomalies Rulebase Rule Properties (continued)
Option
Install On
Comments
For more information, see the IDP Concepts & Examples guide.
Intrusion Detection and Prevention Devices and Security Policies Overview on page 31
Modifying IDP Rulebase Rules (NSM Procedure) on page 36
Configuring Network Honeypot Rulebase Rules (NSM Procedure) on page 54
Assigning a Security Policy in an Intrusion Detection and Prevention Device (NSM
Procedure) on page 117
The network honeypot rulebase is a method to detect investigation activities.
To configure a network honeypot rulebase rule:
In the NSM navigation tree, select Policy Manager > Security Policies.
1.
Select and double-click the security policy to which you want to add the network
2.
honeypot rulebase rule.
Click New in the upper right corner of the policy viewer and select Add Network
3.
Honeypot Rulebase.
Click the New button within the rules viewer to add a rule.
4.
Modify the property of the rule by right-clicking the table cell for the property and
5.
making your modifications.
Configure or modify the rule using the settings described in Table 33 on page 54.
6.
Table 33: Network Honeypot Rulebase Rule Properties
Option
No
Source Address
Function
Specifies the security devices
or templates that receive and
use this rule.
Specifies any miscellaneous
comment about the rule's
purpose.
Function
Specifies if you want to add,
delete, copy, or reorder rules.
Specifies the address object
that is the source of the
traffic.
Your Action
Select the target security device.
NOTE: You can also select
multiple security devices on which
to install the rule.
Enter any additional comments
about the rule.
Your Action
Right-click the table cell for the
rule number and make your
required modifications.
Select any source address or
group.
Copyright © 2010, Juniper Networks, Inc.