Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 Administration Manual page 277

Table B-10 Default Building Blocks (continued)
Building Block
Default-BB-Category
Definition: Windows
Compliance Events
Default-BB-Category
Definition: Worm Events
Default-BB-Compliance
Definition: GLBA Servers
Default-BB-Compliance
Definition: HIPAA Servers
Default-BB-Compliance
Definition: SOX Servers
Default-BB-Compliance
Definition: PCI DSS
Servers
Default-BB-Database:
System Action Allow
Default-BB-Database:
System Action Deny
Default-BB-Database:
User Addition or Change
Default-BB-Device
Definition: Devices to
Monitor for High Event
Rates
Default-BB-FalsePositive:
All Default False Positive
BBs
Default-BB-FalsePositive:
Broadcast Address False
Positive Categories
Block
Group Type
Category Event Edit this BB to include all event
Definitions,
Compliance
Category Event Edit this BB to define worm events.
Definitions
Compliance, Event Edit this BB to include your GLBA
Host
Definitions
Compliance, Event Edit this BB to include your HIPAA
Host
Definitions
Compliance, Event Edit this BB to include your SOX IP
Host
Definitions
Compliance, Event Edit this BB to include your PCI
Host
Definitions,
Response
Category Event Edit this BB to include any events
Definitions,
Compliance
Category Event Edit this BB to include any events
Definitions,
Compliance
Category Event Edit this BB to include events that
Definitions,
Compliance
Category Event Edit this BB to include devices you
Definitions
False Event Edit this BB to include all false
Positive
False Event Edit this BB to define all the false
Positive
STRM Administration Guide
Description
categories that indicate
compliance events.
This BB only applies to events not
detected by a custom rule.
IP systems. You must then apply
this BB to rules related to failed
logins, remote access, etc.
Servers by IP address. You must
then apply this BB to rules related
to failed logins, remote access,
etc.
Servers. You must then apply this
BB to rules related to failed logins,
remote access, etc.
DSS servers by IP address. You
must apply this BB to rules related
to failed logins, remote access,
etc.
that indicates successful actions
within a database.
that indicate unsuccessful actions
within a database.
indicate the successful addition or
change of user privileges
wish to monitor for high event
rates. The event rate threshold is
controlled by the
Default-Rule-Anomaly: Devices
with High Event Rates.
positive building blocks.
positive categories that occur to or
from the broadcast address space.
Default Building Blocks
Associated Building
Blocks, if applicable
All Default-BB-False
Positive building blocks
269