Suspicious Activity - Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - EVENT CATEGORY CORRELATION REFERENCE GUIDE REV 1 Reference Manual

26 E C
VENT ATEGORY
Table 2-13 Malware Categories (continued)
Low Level Event
Category Description
Hostile Software Indicates a hostile software
Download download to your network.
Virus Detected Indicates a virus has been
detected.
Misc Malware Indicates miscellaneous
malicious software
Trojan Detected Indicates a trojan has been
detected.
Spyware Detected Indicates spyware has been
detected on your system.
Content Scan Indicates that an attempted scan
of your content has been
detected.
Content Scan Indicates that a scan of your
Failed content has failed.
Content Scan Indicates that a scan of your
Successful content was successful.
Content Scan in Indicates that a scan of your
Progress content is currently in progress.
Keylogger Indicates that a key logger has
been detected.

Suspicious Activity

Table 2-14 Suspicious Categories
Low Level Event
Category Description
Unknown Indicates an unknown suspicious
Suspicious Event event.
Suspicious Pattern Indicates a suspicious pattern
Detected has been detected.
Content Modified By Indicates that content has been
Firewall modified by the firewall.
Invalid Command or Indicates an invalid command or
Data data.
Suspicious Packet Indicates a suspicious packet.
Suspicious Activity Indicates suspicious activity.
C
ORRELATION
The suspicious activity category indicates events relating to viruses, trojans, back
door attacks, and other forms of hostile software. The associated low-level event
categories include:
STRM Event Category Correlation Reference
Severity Level Event Correlation/
(0 to 10) Processing
6 Correlation Group 2 Scenario 2
8 Correlation Group 2 Scenario 2
4 Correlation Group 2 Scenario 2
7 Correlation Group 2 Scenario 2
6 Correlation Group 2 Scenario 2
3 Correlation Group 2 Scenario 2
8 Correlation Group 2 Scenario 2
3 Correlation Group 2 Scenario 2
3 Correlation Group 2 Scenario 2
7 Correlation Group 2 Scenario 2
Severity Level Event Correlation/
(0 to 10) Processing
3 Correlation Group 2 Scenario 2
3 Correlation Group 2 Scenario 2
3 Correlation Group 2 Scenario 2
3 Correlation Group 2 Scenario 2
3 Correlation Group 2 Scenario 2
3 Correlation Group 2 Scenario 2
Additional Event
Processing
Additional Event
Processing