Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV 1 Manual page 69

The list of offenses appear.
Double-click the offense you wish to view.
Step 5
The details panel appears.
View the Attacker Summary box to understand the attacker:
Step 6
Location - Allows you to determine if the attacker is local or remote:
•
- Local - This field specifies the network (group) in which it is located.
- Remote - This field specifies the geographic location of the attacker, for
example, Asia. We recommend that you investigate the traffic from the
remote source IP address to make sure that your firewalls are probably
configured to block any threatening traffic. If firewall logs are being sent to
STRM, use the Event Viewer to investigate firewall logs to make sure it is
probably configured. For more information on the Event Viewer, see the
STRM Users Guide.
User - If the attacker is local or a VPN user and STRM is receiving user identity
•
logs, this field indicates user identity information. This allows you identify the
user who is the source of the suspicious traffic. To obtain further information
about the user, right-click on the IP address in the Description field to access
additional menu options. From the menu, select use the Select Information >
Asset Profile. The Asset Profile window allows you to determine additional
information regarding the identify of the source user.
If the activity is normal (for example, scanning originating from a known
vulnerability scanner or network management system that may be probing the
network with SNMP traffic) then you can use the Rules function in the Offense
Manager to tune out this activity. For more information, see
Reconnaissance
In the Attacker Summary box, place your mouse over the Magnitude bar. If the VA
Step 7
Risk value is greater than 0, we recommend that you investigate the target to
Category Offense Investigation Guide
How do I Investigate a Reconnaissance Offense?
Offense?.
63
How do I Tune a