Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - EVENT CATEGORY CORRELATION REFERENCE GUIDE REV 1 Reference Manual page 20

14 E C
VENT ATEGORY
Additional Event
Processing
Recon
Table 2-8 Recon Categories
Low Level Event
Category Description
Unknown Form of Indicates an unknown form of
Recon reconnaissance.
Application Query Indicates reconnaissance to
applications on your system.
C
ORRELATION
Table 2-7 Correlation Group 5 Tests (continued)
Traffic Type
Local-to-Remote
Remote-to-Local
Each event is processed using one of the following scenarios:
• Scenario 1 - Event information is forwarded to the Magistrate component by
automatically creating offenses. Even though offenses are created
automatically, no real-time flow analysis is performed. Events are stored in the
Event Processor.
• Scenario 2 - Events are stored in the Event Processor. Offenses are not
automatically created and no flow analysis is performed.
The Recon category indicates events relating to scanning and other techniques
used to identify network resources. The associated low-level event categories
include:
STRM Event Category Correlation Reference
Correlation Rules (Tests)
Correlation Group 5 performs the following tests for
Local-to-Remote traffic:
Relevance of the day of the week
•
Device credibility
•
Event rate
•
Attacker network
•
Time of the attack
•
Note: For test details, see
Correlation Group 5 performs the following tests for
Remote-to-Local traffic:
Relevance of the day of the week
•
Device credibility
•
Event rate
•
Target
•
Target network
•
Time of the attack
•
Note: For test details, see
Severity Level
(0 to 10)
2
3
Table 2-2 .
Table 2-2 .
Event Correlation/ Additional Event
Processing Processing
Correlation Group 2 Scenario 2
Correlation Group 2 Scenario 2