Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT REV 1 Manual page 109

Table B-7 Default Building Blocks (continued)
Building Block
Default-BB-Category
Definition: Recon Events
Default-BB-Category
Definition: Service DoS
Default-BB-Category
Definition: Suspicious
Events
Default-BB-Category
Definition: System Errors
and Failures
Default-BB-Category
Definition: Upload to Local
WebServer
Default-BB-Category
Definition: VoIP
Authentication Failure
Events
Default-BB-Category
Definition: VoIP Session
Opened
Default-BB-Category
Definition: Windows
Compliance Events
Default-BB-Category
Definition: Worm Events
Block
Group Type
Category Event Edit this BB to include all events
Definitions
Category Event Edit this BB to define Denial of
Definitions
Category Event Edit this BB to include all events
Definitions
Category Event Edit this BB to include all events
Definitions
Category Event Typically, most networks are
Definitions
Category Event Edit this BB to include all events
Definitions
Category Event Edit this BB to include all events
Definitions
Category Event Edit this BB to include all event
Definitions
Category Event Edit this BB to define worm events.
Definitions
STRM Log Management Users Guide
Description
that indicate reconnaissance
activity.
Service (DoS) attack events.
that indicate suspicious activity.
that may indicate a system error or
failure. By default, this BB applies
when the event category for the
event is one of the following
System categories:
• Service Failure
• System Error
• System Failure
configured to restrict applications
that use the PUT method running
on their web application servers.
This BB detects if a remote host
has used this method on a local
server. The BB could be
duplicated to also detect other
unwanted methods or for local
hosts using the method connecting
to remote servers. This building
block is referenced by the
Default-Rule-Policy: Upload to
Local WebServer rule.
that indicate a VoIP login failure.
that indicate the start of a VoIP
session.
categories that indicate
compliance events.
This BB only applies to events not
detected by a custom rule.
Default Building Blocks
Associated Building
Blocks, if applicable
103