Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT REV 1 Manual page 108

102 D R
EFAULT ULES AND
Table B-7 Default Building Blocks (continued)
Building Block
Default-BB-Category
Definition: Firewall
System Errors
Default-BB-Category
Definition: High
Magnitude Events
Default-BB-Category
Definitions: KeyLoggers
Default-BB-Category
Definition: Mail Policy
Violation
Default-BB-Category
Definition: Malware
Annoyances
Default-BB-Category
Definition: Network DoS
Attack
Default-BB-Category
Definition: Policy Events
Default-BB-Category
Definition: Post Exploit
Account Activity
Default-BB-Category
Definition: Rate Analysis
Marked Events
B B
UILDING LOCKS
Block
Group Type
Category Event Edit this BB to include all events
Definitions
Category Event Edit this BB to the severity,
Definitions
Category Event Edit this BB to include all events
Definitions
Category Event Edit this BB to define mail policy
Definitions
Category Event Edit this BB to include event
Definitions
Category Event Edit this BB to include all event
Definitions
Category Event Edit this BB to include all event
Definitions
Category Event Edit this BB to include all event
Definitions
Category Event STRM monitors event rates of all
Definitions
STRM Log Management Users Guide
Description
that may indicate a firewall system
error. By default, this BB applies
when an event is detected by one
or more of the following devices:
• CheckPoint
• Generic Firewall
• Iptables
• NetScreen Firewall
• Cisco Pix
credibility, and relevance levels
you wish to generate an event.
The defaults are:
• Severity = 6
• Credibility = 7
• Relevance = 7
that are typically exploits,
backdoor, or trojans.
violations.
categories that are typically
associated with spyware
infections.
categories that you wish to
categorize as a network DoS
attack.
categories that may indicate a
violation to network policy.
categories that may indicate
exploits to accounts.
source IP addresses/QIDs and
destination IP addresses/QIDs and
marks events that exhibit abnormal
rate behavior.
Edit this BB to include events that
are marked with rate analysis.
Associated Building
Blocks, if applicable