Working With Idp Attack Objects; Viewing Predefined Idp Attacks; Viewing Predefined Idp Attack Groups - Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Administration Manual

Working with IDP Attack Objects

Viewing Predefined IDP Attacks

Viewing Predefined IDP Attack Groups

Copyright © 2010, Juniper Networks, Inc.
to be considered part of the same attack. Possible values are Source, Destination,
Destination Port, and Protocol; Source; Destination; From Zone, Destination,
Destination Port, and Protocol; and From Zone.
Timeout (sec.). A period of time following brute force attack detection during
which the security device performs an IP action on packets matching specified
target parameters. The default is 60 seconds.
After you have created the DI Profile object, you can use the object in your firewall rules.
NSM contains a database of predefined IDP attack objects and IDP attack object groups
that you can use in security policies to match traffic against known and unknown attacks.
Juniper Networks updates the predefined attack objects and groups on a regular basis
with newly-discovered attack patterns.
The Predefined Attacks tab displays all attacks in a table format and includes the
following information:
Name of the attack object
Severity of the attack: critical, major, minor, warning, or info
Category displaying the type of application
Keywords for the attack
CVE number, identifying the number of the attack in the Common Vulnerabilities and
Exposures database
Bugtraq number, identifying the equivalent attack in the Security Focus Bugtraq
database
By default, attack objects are listed alphabetically by Category name. To view attacks
in a different order, click on a column heading. To display a detailed description of an
attack object, double-click the attack.
To view attack object details, right-click the attack object and select View to display the
attack viewer.
The Predefined Attack Group tab displays the following predefined attack groups:
All Attacks—A list of all attack objects, organized in the categories described below.
Recommended Attacks—A list of all attack object objects that Juniper Networks
considers to be serious threats, organized into categories.
Chapter 8: Configuring Objects
341