Default Rules - Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 Administration Manual

298 U T
NIVERSITY EMPLATE

Default Rules

Table B-9 Default Rules
Rule
Default-Response-
E-mail: Offense E-mail
Sender
Default-Response-
Sylog: Offense
SYSLOG Sender
Default-Rule-Anomaly:
Devices with High Event
Rates
Default-Rule-Anomaly:
Excessive Database
Connections
Default-Rule-
Anomaly: Excessive
Firewall Accepts Across
Multiple Hosts
Default-Rule-
Anomaly: Excessive
Firewall Denies from
Single Source
Default-Rule-
Anomaly: Long Duration
Flow
Default-Rule-
Anomaly: Potential
Honeypot Access
D
EFAULTS
Default rules for the University template include:
Rule
Group Type
Response Offense
Response Offense
Anomaly Event
Anomaly Event
Anomaly Event
Anomaly Event
Anomaly Event
Anomaly Event
STRM Administration Guide
Enabled Description
False Reports any offense matching the severity,
credibility, and relevance minimums to e-mail.
You must configure the e-mail address. You can
limit the number of e-mails sent by tuning the
severity, credibility, and relevance limits. Also,
this rule only sends one e-mail every hour, per
offense.
False Reports any offense matching the severity,
credibility, or relevance minimum to syslog.
False Monitors devices for high event rates. Typically,
the default threshold is low for most networks
and we recommend that you adjust this value
before enabling this rule. To configure which
devices will be monitored, edit the
Default-BB-DeviceDefinition: Devices to Monitor
for High Event Rates building block.
True Reports an excessive number of successful
database connections.
False Reports excessive firewall accepts across
multiple hosts. More than 100 events were
detected across at least 100 unique destination
IP addresses in 5 minutes.
True Reports excessive firewall denies from a single
host. Detects more than 400 firewall deny
attempts from a single source to a single
destination within 5 minutes.
False Reports a flow communicating to or from the
Internet with a sustained duration of more than
48 hours. This is not typical behavior for most
applications. We recommend that you
investigate the host for potential malware
infections.
False Reports an event that was targeting or sourced
from a honeypot or tarpit defined address.
Before enabling this rule, you must configure the
Default-BB-HostDefinition: Honeypot like
addresses building block and create the
appropriate sentry from the Network
Surveillance interface.