Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 Administration Manual page 312

304 U T
NIVERSITY EMPLATE
Table B-9 Default Rules (continued)
Rule
Default-Rule-Policy:
New Host Discovered in
DMZ
Default-Rule-Policy:
New Service
Discovered
Default-Rule-Policy:
New Service
Discovered in DMZ
Default-Rule-Policy:
Upload to Local
WebServer
Default-Rule-Recon:
Aggressive Local
Scanner Detected
Default-Rule-Recon:
Aggressive Remote
Scanner Detected
Default-Rule-Recon:
Excessive Firewall
Denies From Local Host
Default-Rule-Recon:
Excessive Firewall
Denies From Remote
Host
Default-Rule-Recon:
Host Port Scan
Detected by Local Host
Default-Rule-Recon:
Host Port Scan
Detected by Remote
Host
Default-Rule-Recon:
Increase Magnitude of
High Rate Scans
Default-Rule-Recon:
Increase Magnitude of
Medium Rate Scans
D
EFAULTS
Rule
Group Type
Authentication, Event
Compliance
Policy Event
Authentication, Event
Compliance
Policy Event
Recon Event
Recon Event
Recon Event
Recon Event
Recon Event
Recon Event
Recon Event
Recon Event
STRM Administration Guide
Enabled Description
False Reports when a new host has been discovered
in the DMZ.
False Reports when an existing host has a newly
discovered service.
False Reports when a new service has been
discovered in the DMZ.
False Reports potential file uploads to a local web
server. To edit the details of this rule, edit the
Default-BB-CategoryDefinition: Upload to Local
WebServer building block.
True Reports an aggressive scan from a local source
IP address, scanning other local or remote IP
addresses. This may indicate a manually driven
scan, an exploited host searching for other
targets, or a worm is present on the system.
True Reports an aggressive scan from a remote
source IP address, scanning other local or
remote IP addresses. This may indicate a
manually driven scan, an exploited host
searching for other targets, or a worm on a
system.
True Reports excessive attempts, from a local host, to
access the firewall and access is denied. More
than 40 attempts are detected across at least 40
destination IP addresses in 5 minutes.
True Reports excessive attempts, from a remote host,
to access the firewall and access is denied.
More than 40 attempts are detected across at
least 40 destination IP addresses in 5 minutes.
True Reports a single source IP address scanning
more than 50 ports in under 3 minutes.
True Reports when more than 50 ports were scanned
from a single source IP address in under 3
minutes.
True If a high rate flow-based scanning attack is
detected, this rule increases the magnitude of
the current event.
True If a medium rate flow-based scanning attack is
detected, this rule increases the magnitude of
the current event.