Potential Exploit Offenses; What Is A Potential Exploit Offense; How Do I Investigate A Potential Exploit Offense - Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV 1 Manual

10
What is a Potential
Exploit Offense?
How do I
Investigate a
Potential Exploit
Offense?
Step 1
Step 2
P
OTENTIAL
This chapter provides information on potential exploit offenses including:

What is a Potential Exploit Offense?

•

How do I Investigate a Potential Exploit Offense?

•
• How do I Tune a Potential Exploit Offense?
Potential exploit offenses may be generated from many different sources, such as,
a custom rule created in STRM or from an Intrusion Detection System
(IDS)/Intrusion Prevention System (IPS) product with a high false positive prone
signature. If offenses are categorized as potential exploits, we recommend that
you investigate the users associated with the offense to validate the authenticity of
the offense.
This section provides information on further investigating a potential exploit
offense.
To investigate a potential exploit offenses:
Click the Offense Manager tab.
The Offense Manager window appears.
Click By Category from the navigation menu.
The By Category view appears displaying high-level categories. The counts for
each category are accumulated from the values in the low-level categories.
Hint: Only low-level categories with associated offenses appear with an arrow.
You can click the arrow to view the associated low-level categories. If you wish to
view all categories, click Show Inactive Categories.
Category Offense Investigation Guide
E O
XPLOIT FFENSES