Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 Administration Manual page 275

Table B-10 Default Building Blocks (continued)
Building Block
Default-BB-Category
Definition: Firewall
System Errors
Default-BB-Category
Definition: Flow Events
Default-BB-Category
Definition: High
Magnitude Events
Default-BB-Category
Definitions: KeyLoggers
Default-BB-Category
Definition: Mail Policy
Violation
Default-BB-Category
Definition: Malware
Annoyances
Default-BB-Category
Definition: Network DoS
Attack
Default-BB-Category
Definition: Policy Events,
Compliance
Default-BB-Category
Definition: Post Exploit
Account Activity
Block
Group Type
Category Event Edit this BB to include all events
Definitions
Category Event Edit this BB to include all events
Definitions
Category Event Edit this BB to the severity,
Definitions
Category Event Edit this BB to include all events
Definitions
Category Event Edit this BB to define mail policy
Definitions,
Compliance
Category Event Edit this BB to include event
Definitions
Category Event Edit this BB to include all event
Definitions
Category Event Edit this BB to include all event
Definitions
Category Event Edit this BB to include all event
Definitions
STRM Administration Guide
Description
that may indicate a firewall system
error. By default, this BB applies
when an event is detected by one
or more of the following devices:
• CheckPoint
• Generic Firewall
• Iptables
• NetScreen Firewall
• Cisco Pix
that indicate flow events within
your network. By default, this BB
applies to events detected by the
Classification Engine.
credibility, and relevance levels
you wish to generate an event.
The defaults are:
• Severity = 6
• Credibility = 7
• Relevance = 7
that are typically exploits,
backdoor, or trojans.
violations.
categories that are typically
associated with spyware
infections.
categories that you wish to
categorize as a network DoS
attack.
categories that may indicate a
violation to network policy.
categories that may indicate
exploits to accounts.
Default Building Blocks
Associated Building
Blocks, if applicable
267