Enterprise Template Defaults; Default Sentries - Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 Administration Manual

238 E T
NTERPRISE EMPLATE
D
EFAULTS
Table B-1 Default Sentries (continued)
Sentry
Default - Suspicious - Internal
- Inbound Unidirectional
Flows Threshold
DoS - External - Distributed
DoS Attack (High Number of
Hosts)
DoS - External - Distributed
DoS Attack (Low Number of
Hosts)
DoS - External - Distributed
DoS Attack (Medium Number
of Hosts)
DoS - External - Flood Attack
(High)
DoS - External - Flood Attack
(Medium)
DoS - External - Flood Attack
(Low)
DoS - External - Potential
ICMP DoS
DoS - External - Potential
TCP DoS
DoS - External - Potential
UDP DoS
DoS - External - Potential
Unresponsive Service or
Distributed DoS
Default - Suspicious - Internal
- Inbound Unidirectional
Flows Threshold
DoS - Internal - Distributed
DoS Attack (High Number of
Hosts)
STRM Administration Guide
Description
Detects an excessive rate (more than 1000) of
inbound unidirectional (local host not responding)
flows within the last 5 minutes. This may indicate a
scan is in progress, worms, DoS attack, or issues with
your network configuration. By default, this activity
must occur 5 times before an alert generates.
Detects a large number of hosts (100,000) sending
identical, non-responsive packets to a single target. In
this case, the target is treated as the attacker in the
Offense Manager.
Detects a low number of hosts (500) sending identical,
non-responsive packets to a single target. In this
case, the target is treated as the attacker in the
Offense Manager.
Detects a medium number of hosts (5000) sending
identical, non-responsive packets to a single target. In
this case, the target is treated as the attacker in the
Offense Manager.
Detects flood attacks above 100,000 packets per
second. This activity may indicate a serious attack.
Detects flood attacks above 5000 packets per second.
This activity typically indicates a serious attack.
Detects flood attacks above 500 packets per second.
This activity may indicate an attack.
Detects flows that appear to be an ICMP Denial of
Service (DoS) attack attempt.
Detects flows that appear to be a TCP DoS attack
attempt.
Detects flows that appear to be a UDP DoS attack
attempt.
Detects a low number of hosts sending identical,
non-responsive packets to a single target.
Detects an excessive rate (more than 1000) of
inbound unidirectional (local host not responding)
flows within the last 5 minutes. This may indicate a
scan is in progress, worms, DoS attack, or issues with
your network configuration. By default, this activity
must occur 5 times before an alert generates.
Detects a large number of hosts (100,000) sending
identical, non-responsive packets to a single target. In
this case, the target is treated as the attacker in the
Offense Manager.