Default Building Blocks - Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 Administration Manual

346 ISP T D
EMPLATE EFAULTS
Default Building
Blocks
Table D-10 Default Building Blocks
Building Block
Default-BB-Category
Definition: Authentication
Failures
Default-BB-Category
Definition: Authentication
Success
Table D-9 Default Rules (continued)
Rule
Default-Rule-Recon:
Remote Windows
Server Scanner
Default-Rule-Recon:
Single Merged Recon
Events
Default-Rule-Recon:
Multiple System
Errors
Default-Rule-Worm
Detection: Local Mass
Mailing Host Detected
Default-Rule-Worm
Detection: Possible
Local Worm Detected
Default-Rule-Worm
Detection: Worm
Detected (Events)
Default building blocks for the ISP template include:
Block
Type Description
Event Edit this BB to include all events that
indicate an unsuccessful attempt to access
the network.
Event Edit this BB to include all events that
indicate successful attempts to access the
network.
STRM Administration Guide
Rule
Type Enabled Description
Event True Reports a remote host attempting
reconnaissance or suspicious
connections on common Windows
server ports to more than 60 hosts in 10
minutes.
Event False Reports merged reconnaissance events
generated by some devices. This rule
causes all these events to create an
offense. All devices of this type and their
categories should be added to the
Default-BB-ReconDetected: Devices
which Merge Recon into Single Events
building block.
Event False Detects when as source has 10 system
errors within 3 minutes.
Event True Reports a local host sending more than
20 SMTP flows in 1 minute. This may
indicate a host being used as a spam
relay or infected with a form of mass
mailing worm.
Event True Reports a local host generating
reconnaissance or suspicious events
across a large number of hosts (greater
than 300) in 20 minutes. This may
indicate the presence of a worm on the
network or a wide spread scan.
Event True Reports exploits or worm activity on a
system for local-to-local or
local-to-remote traffic.
Associated Building Blocks,
if applicable