Using The Log Investigator - Juniper NETWORK AND SECURITY MANAGER 2010.2 - ADMINISTRATION GUIDE REV1 Administration Manual

Network and Security Manager Administration Guide

Using the Log Investigator

752
The Log Investigator module enables you to investigate patterns and trends on your
network using data gathered from your log entries. Log entries are generated by a security
device when traffic matches a security policy rule, or when an event occurs that matches
a predefined set of conditions. The Log Investigator uses the event data recorded in the
log entry to identify the destination IP addresses and ports that are attacked most
frequently, the services that are used to attack most frequently, and the source IP
addresses that most frequently generate attacks.
When using NSM to manage large networks with multiple managed devices, you can
potentially receive several hundred log entries in a single day (depending on how you
have configured your devices for logging). The Log Investigator is a helpful tool for
manipulating and correlating a large volume of log entry data so you can identify and
analyze important activity that might threaten your network. By analyzing your data and
then using that knowledge to proactively fine-tune your security policies, you can decrease
risk while increasing security.
This section provides details on the following Log Investigator functionality:
"About the Log Investigator UI" on page 753—The Log Investigator main display area
includes a filter summary, a log entry matrix, and two detail panes that display detail
information in table and chart format.
"Configuring Log Investigator Options" on page 754—Configure the criteria the Log
Investigator uses to create the matrix, including the time period, Left and Top Axes
settings, the data point count (the number of data points the Log Investigator must
collect before displaying data), and the maximum number of log entries you want the
Log Investigator to use when collecting data.
"Setting Log Investigator Filters" on page 757—As in the Log Viewer, you can set filters
on log entry data so the Log Investigator displays only the information you want to see.
Apply multiple filters to data for all log entry columns found in the Log Viewer.
"Investigating Log Entry Data" on page 759—After you have configured the Log
Investigator filters, time period, and data options, you are ready to begin investigating
your log entry information. Within any cell the Log Investigator table, you can right-click
and select an option to view specific details, including Destination Ports, Subcategories,
and Time Period.
"Zoom Details" on page 761—You can zoom in on specific details about activity between
two data types, select a third data type for comparison, or display details about the
event over time.
"Jumping to the Log Viewer" on page 762—You can use the Log Viewer to see the
corresponding log entries that are used in Log Investigator calculations
"Excluding Data" on page 762—You can configure the Log Investigator to exclude data
for a cell, row, or column in the Log Investigator matrix.
Copyright © 2010, Juniper Networks, Inc.