Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 Administration Manual page 359

Table D-10 Default Building Blocks (continued)
Building Block
Default-BB-FalsePositive:
Remote Attacker to
Internal Target False
Positives
Default-BB-FalsePositive:
RPC Server False
Positive Categories
Default-BB-FalsePositive:
RPC Server False
Positive Events
Default-BB-FalsePositive:
SNMP Sender or
Receiver False Positive
Categories
Default-BB-FalsePositive:
SNMP Sender or
Receiver False Positive
Events
Default-BB-FalsePositive:
Source IP and Specific
Event
Default-BB-FalsePositive:
SSH Server False
Positive Categories
Default-BB-FalsePositive:
SSH Server False
Positive Events
Default-BB-FalsePositive:
Syslog Sender False
Positive Categories
Default-BB-FalsePositive:
Syslog Sender False
Positive Events
Block
Type Description
Event Edit this BB to define all the false positive
QIDs that occur to or from Remote-to-Local
(R2L) based servers.
Event Edit this BB to define all the false positive
categories that occur to or from RPC
servers that are defined in the
Default-BB-HostDefinition: RPC Servers
building block.
Event Edit this BB to define all the false positive
QIDs that occur to or from RPC servers that
are defined in the
Default-BB-HostDefinition: RPC Servers
building block.
Event Edit this BB to define all the false positive
categories that occur to or from SNMP
servers that are defined in the
Default-BB-HostDefinition: SNMP Servers
building block.
Event Edit this BB to define all the false positive
QIDs that occur to or from SNMP servers
that are defined in the
Default-BB-HostDefinition: SNMP Servers
building block.
Event Edit this BB to include source IP addresses
or specific events that you wish to remove.
Event Edit this BB to define all the false positive
categories that occur to or from SSH
servers that are defined in the
Default-BB-HostDefinition: SSH Servers
building block.
Event Edit this BB to define all the false positive
QIDs that occur to or from SSH servers that
are defined in the
Default-BB-HostDefinition: SSH Servers
building block.
Event Edit this BB to define all false positive
categories that occur to or from syslog
sources.
Event Edit this BB to define all false positive
events that occur to or from syslog sources
or destinations.
STRM Administration Guide
Default Building Blocks
Associated Building Blocks,
if applicable
Default-BB-HostDefinition: RPC
Servers
Default-BB-HostDefinition: RPC
Servers
Default-BB-HostDefinition:
SNMP Servers
Default-BB-HostDefinition: SSH
Servers
Default-BB-HostDefinition: SSH
Servers
Default-BB-HostDefinition:
Syslog Servers and Senders
Default-BB-HostDefinition:
Syslog Servers and Senders
351