Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 Administration Manual page 194

186 C R
ONFIGURING ULES
Table 9-1 Functions Group (continued)
Test Description
Multi-Rule You can also use building
Function blocks or existing rules to
populate this test. Allows you to
detect the selected rules with
same source information across
more than the configured
number of destinations within a
configured time period.
Table 9-2 Offense Function Group
Test Description
Multi-Rule Allows you to use saved
Offense building blocks and other
Function rules to populate this test. The
offense has to match either all
or any of the selected rules. If
you wish to create an OR
statement for this rule test,
specify the any parameter.
The Offense functions include:
Default Test Name
when the offense
matches any of the
following offense rules.
STRM Administration Guide
Default Test Name
when any of these
rules with the same IP
address/Port/QID/
Event/Device/
Category more than 5
times, across more
than 5 IP address/
Port/QID/Event/
Device/Category
within 10 minutes
Parameters
Configure the following parameters:
rules - Specify the rules you wish
•
this test to consider.
IP address/Port/QID/
•
Event/Device/ Category - Specify
whether you wish this rule to
consider a source IP address,
source port, QID, device event ID,
device, or category.
5 - Specify the number of rules you
•
wish this test to consider.
more than - Specify if you wish
•
this test to consider more than or
exactly the number of destination
IP address(es), destination port(s),
QID(s), Device Event ID(s), or
Device(s).
5 - Specify the number of IP
•
addresses, ports, QIDs, events,
devices, or categories you wish
this test to consider.
IP address/ Port/QID/Event/
•
Device/Category - Specify the
destination you wish this test to
consider. The options are:
anything, destination IP(s),
destination port(s), QID(s), Device
Event ID(s), or Device(s).
10 - Specify the time value you
•
wish to assign to this test.
minutes - Specify the time
•
measurement value, seconds,
minutes, hours, or days that you
wish to apply to this test.
Parameters
Configure the following parameters:
any - Specify either any or all of
•
the configured rules apply to this
test.
rules - Specify the rules you wish
•
this test to consider.