How Do I Tune A Reconnaissance Offense; Tuning Using False Positive Function - Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV 1 Manual

Step 11
Step 12
How do I Tune a
Reconnaissance
Offense?
Tuning Using False
Positive Function
Step 1
Once you have determined the impact of the offense, you must either block the
source of the scan, patch or shut down services on the appropriate systems, then
take the desired action against the offense.
Once you have resolved the offense, close or hide the offense.
For more information on closing or hiding an offense, see the STRM Users Guide.
If you determine that the reconnaissance activity is normal and STRM is creating
false positive offenses, you can tune STRM to make sure no more offenses are
created due to this activity.
You can tune STRM using one of the following methods:

Tuning Using False Positive Function

•
Tuning Using Custom Rules Wizard
•
To tune reconnaissance activity using the false positive function:
In the reconnaissance offense details interface, click
The List of Events appears for the selected offense.
Category Offense Investigation Guide

How do I Tune a Reconnaissance Offense?

Events.
65