Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - EVENT CATEGORY CORRELATION REFERENCE GUIDE REV 1 Reference Manual page 31

Table 2-12 Exploit Categories (continued)
Low Level Event
Category
Session Hijack
Worm Active
Password
Guess/Retrieve
FTP Exploit
RPC Exploit
SNMP Exploit
NOOP Exploit
Samba Exploit
Database Exploit
SSH Exploit
ICMP Exploit
UDP Exploit
Browser Exploit
DHCP Exploit
Remote Access
Exploit
ActiveX Exploit
SQL Injection
Malware
Table 2-13 Malware Categories
Low Level Event
Category Description
Unknown Malware Indicates an unknown virus.
Backdoor Detected Indicates that a backdoor to the
system has been detected.
Hostile Mail Indicates a hostile mail
Attachment attachment.
Malicious Software Indicates a virus.
Description
Indicates a session in your
network has been interceded.
Indicates an active worm.
Indicates that a user has
requested access to their
password information from the
database.
Indicates an FTP exploit.
Indicates an RPC exploit.
Indicates an SNMP exploit.
Indicates an NOOP exploit.
Indicates an Samba exploit.
Indicates a database exploit.
Indicates an SSH exploit.
Indicates an ICMP exploit.
Indicates a UDP exploit.
Indicates an exploit on your
browser.
Indicates a DHCP exploit
Indicates a remote access
exploit
Indicates an exploit through an
ActiveX application.
Indicates that an SQL injection
has occurred.
The malicious software (malware) category indicates events relating to application
exploits and buffer overflow attempts. The associated low-level event categories
include:
STRM Event Category Correlation Reference
Severity Level Event Correlation/
(0 to 10) Processing
9 Correlation Group 2 Scenario 2
10 Correlation Group 1 Scenario 2
9 Correlation Group 2 Scenario 2
9 Correlation Group 1 Scenario 2
9 Correlation Group 1 Scenario 2
9 Correlation Group 1 Scenario 2
9 Correlation Group 1 Scenario 2
9 Correlation Group 1 Scenario 2
9 Correlation Group 1 Scenario 2
9 Correlation Group 1 Scenario 2
9 Correlation Group 1 Scenario 2
9 Correlation Group 1 Scenario 2
9 Correlation Group 1 Scenario 2
9 Correlation Group 1 Scenario 2
9 Correlation Group 1 Scenario 2
9 Correlation Group 1 Scenario 2
9 Correlation Group 1 Scenario 2
Severity Level Event Correlation/
(0 to 10) Processing
4 Correlation Group 2 Scenario 2
9 Correlation Group 2 Scenario 2
6 Correlation Group 2 Scenario 2
6 Correlation Group 2 Scenario 2
Malware 25
Additional Event
Processing
Additional Event
Processing