Threats Group - Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 Administration Manual

290 U T
NIVERSITY EMPLATE

Threats Group

D
EFAULTS
Pre-configured groups that specify traffic flows from suspicious IP addresses,
protocols, server ports, and network sweeps including:
Table B-3 Custom Views - Threats View
Group Objects
Exceptions This group includes:
Network_Management_Hosts - Defines network management
servers or other system responsible for reconnaissance, SNMP,
large numbers of ICMP requests, or other attacks, such as, traffic
on your network such as vulnerability assessment (VA) scanners.
DoS The Denial of Service (DoS) group includes:
•
• Inbound_Flood_NoResponse_Medium - Defines a remote source
• Inbound_Flood_NoResponse_Low - Defines a remote source
• Outbound_Flood_NoResponse_High - Defines a local source
• Outbound_Flood_NoResponse_Medium - Defines a local source
• Outbound_Flood_NoResponse_Low - Defines a local source
• Multihost_Attack_High - Defines a scan of more than 100,000 hosts
• Multihost_Attack_Medium - Defines a scan of more than 5,000
• Multihost_Attack_Low - Defines a scan of more than 500 hosts per
• Potential_TCP_DoS - Detects TCP Syn flood flows with a packet
• Potential_UDP_DoS - Detects UDP Flows with a packet arrival rate
• Potential_ICMP_DoS - Detects ICMP flows with a packet arrival rate
• Potential_Multihost_Attack - Detects type B superflows. This may
STRM Administration Guide
Inbound_Flood_NoResponse_High - Defines a remote source
sending packets, which are not being responded to, at a rate greater
than 100,000 packets per second.
sending packets, which are not being responded to, at a rate greater
than 5,000 packets per second.
sending packets, which are not being responded to, at a rate greater
than 500 packets per second.
sending packets, which are not being responded to, at a rate greater
than 100,000 packets per second.
sending packets, which are not being responded to, at a rate greater
than 500 packets per second.
sending packets, which are not being responded to, at a rate greater
than 500 packets per second.
per minute.
hosts per minute.
minute.
arrival rate of more then 300 packets per second and have lasted for
at least 5 seconds. This may indicate an attempted TCP DoS attack.
of more then 750 packets per second and have lasted for at least 3
seconds. This may indicate an attempted ICMP DoS attack.
of more then 300 packets per second and have lasted for at least 2
seconds. This may indicate an attempted ICMP DoS attack.
indicate a service failure or an attack.