Configuring Network Honeypot Rulebase Rules (Nsm Procedure) - Juniper NETWORK AND SECURITY MANAGER 2010.4 - CONFIGURING INTRUSION DETECTION PREVENTION DEVICES GUIDE REV 01 Manual

Configuring Intrusion Detection and Prevention Devices Guide
Related
Documentation

Configuring Network Honeypot Rulebase Rules (NSM Procedure)

54
Table 32: Traffic Anomalies Rulebase Rule Properties (continued)
Option
VLAN Tag
Severity
Install On
Comments
For more information, see the IDP Concepts & Examples guide.
Intrusion Detection and Prevention Devices and Security Policies Overview on page 31
Modifying IDP Rulebase Rules (NSM Procedure) on page 36
Configuring Network Honeypot Rulebase Rules (NSM Procedure) on page 54
Assigning a Security Policy in an Intrusion Detection and Prevention Device (NSM
Procedure) on page 119
The network honeypot rulebase is a method to detect investigation activities.
To configure a network honeypot rulebase rule:
In the NSM navigation tree, select Policy Manager > Security Policies.
1.
Select and double-click the security policy to which you want to add the network
2.
honeypot rulebase rule.
Function
Specifies that you can
configure a rule to only apply
to messages in certain VLANs.
Specifies if you can override
the inherent attack severity
on a per-rule basis within the
IDP rulebase.
Specifies the security devices
or templates that receive and
use this rule.
Specifies any miscellaneous
comment about the rule's
purpose.
Your Action
Set a value by selecting any of the
following options:
Any—This rule is applied to
messages in any VLAN and to
messages without a VLAN tag.
None—This rule is applied only
to messages that do not have a
VLAN tag.
Select VLAN Tags—Specifies
which VLAN tags the rule
applies to.
Set the severity to Default, Info,
Warning, Minor, or Critical.
NOTE: This column only appears
when you view the Security Policy
in Expanded Mode.
Select the target security device.
NOTE: You can also select
multiple security devices on which
to install the rule.
Enter any additional comments
about the rule.
Copyright © 2010, Juniper Networks, Inc.