Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 Administration Manual page 206

198 C R
ONFIGURING ULES
Table 9-7 IP / Port Test Group (continued)
Test Description
Remote Port Valid when the remote port
of the event is one of the
configured remote port(s).
Source IP Valid when the source IP
Address address of the event is one
of the configured IP
address(es).
Destination IP Valid when the destination
Address IP address of the event is
one of the configured IP
address(es).
Local IP Valid when the local IP
Address address of the event is one
of the configured IP
address(es).
Remote IP Valid when the remote IP
Address address of the event is one
of the configured IP
address(es).
IP Address Valid when the source or
destination IP address of
the event is one of the
configured IP address(es).
Table 9-8 Host Profile Tests
Test Description
Host Profile Valid when the port is open on
Port the configured local source or
destination. You can also specify
if the status of the port is
detected using one of the
following methods:
Active - STRM actively
•
searches for the configured
port through scanning or
vulnerability assessment.
Passive - STRM passively
•
monitors the network
recording hosts previously
detected.
Default Test Name
when the remote port is one
of the following ports
when the source IP is one
of the following IP
addresses
when the destination IP is
one of the following IP
addresses
when the local IP is one of
the following IP addresses
when the remote IP is one
of the following IP
addresses
when either the source or
destination IP is one of the
following IP addresses
Host Profile Tests
The host profile tests include:
STRM Administration Guide
Default Test Name
when the local source
host destination port is
open either actively
or passively seen
Parameters
ports - Specify the ports you wish
this test to consider.
IP addresses - Specify the IP
address(es) you wish this test to
consider.
IP addresses - Specify the IP
address(es) you wish this test to
consider.
IP addresses - Specify the IP
address(es) you wish this test to
consider.
IP addresses - Specify the IP
address(es) you wish this test to
consider.
IP addresses - Specify the IP
address(es) you wish this test to
consider.
Parameters
Configure the following parameters:
source - Specify if you wish this
•
test to apply to the source or
destination port. The default is
source.
either actively or passively -
•
Specify if you wish this test to
consider active and/or passive
scanning.