Policy Offenses; What Is A Policy Offense; How Do I Investigate A Policy Offense - Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV 1 Manual

9
What is a Policy
Offense?
How do I
Investigate a Policy
Offense?
Step 1
Step 2
P O
OLICY
This chapter provides information on policy offenses including:

What is a Policy Offense?

•

How do I Investigate a Policy Offense?

•
• How do I Tune a Policy Offense?
• How Can I Verify That STRM is Receiving Valid Offenses?
Policy offenses include correlated events that may constitute violations of security
policy, misuse, or wasted resources. This may include Peer-to-Peer (P2P) traffic,
instant messaging traffic, gaming, potential information leaks, or suspicious web
browsing activity. You can configure STRM to adhere to your company policy and
create offenses on traffic that you consider outside your policy.
To investigate a policy offense:
Click the Offense Manager tab.
The Offense Manager window appears.
Click By Category from the navigation menu.
The By Category view appears displaying high-level categories. The counts for
each category are accumulated from the values in the low-level categories.
Hint: Only low-level categories with associated offenses appear with an arrow.
You can click the arrow to view the associated low-level categories. If you wish to
view all categories, click Show Inactive Categories.
Category Offense Investigation Guide
FFENSES