Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT REV 1 Manual page 113

Table B-7 Default Building Blocks (continued)
Building Block
Default-BB-FalsePositive:
Remote Attacker to
Internal Target False
Positives
Default-BB-FalsePositive:
RPC Server False
Positive Categories
Default-BB-FalsePositive:
RPC Server False
Positive Events
Default-BB-FalsePositive:
SNMP Sender or
Receiver False Positive
Categories
Default-BB-FalsePositive:
SNMP Sender or
Receiver False Positive
Events
Default-BB-FalsePositive:
Source IP and Specific
Event
Default-BB-FalsePositive:
SSH Server False
Positive Categories
Default-BB-FalsePositive:
SSH Server False
Positive Events
Default-BB-FalsePositive:
Syslog Sender False
Positive Categories
Default-BB-FalsePositive:
Syslog Sender False
Positive Events
Block
Group Type
False Event Edit this BB to define all the false
Positive
False Event Edit this BB to define all the false
Positive
False Event Edit this BB to define all the false
Positive
False Event Edit this BB to define all the false
Positive
False Event Edit this BB to define all the false
Positive
False Event Edit this BB to include source IP
Positive
False Event Edit this BB to define all the false
Positive
False Event Edit this BB to define all the false
Positive
False Event Edit this BB to define all false
Positive
False Event Edit this BB to define all false
Positive
STRM Log Management Users Guide
Description
positive QIDs that occur to or from
Remote-to-Local (R2L) based
servers.
positive categories that occur to or
from RPC servers that are defined
in the Default-BB-HostDefinition:
RPC Servers building block.
positive QIDs that occur to or from
RPC servers that are defined in
the Default-BB-HostDefinition:
RPC Servers building block.
positive categories that occur to or
from SNMP servers that are
defined in the
Default-BB-HostDefinition: SNMP
Servers building block.
positive QIDs that occur to or from
SNMP servers that are defined in
the Default-BB-HostDefinition:
SNMP Servers building block.
addresses or specific events that
you wish to remove.
positive categories that occur to or
from SSH servers that are defined
in the Default-BB-HostDefinition:
SSH Servers building block.
positive QIDs that occur to or from
SSH servers that are defined in the
Default-BB-HostDefinition: SSH
Servers building block.
positive categories that occur to or
from syslog sources.
positive events that occur to or
from syslog sources or
destinations.
Default Building Blocks
Associated Building
Blocks, if applicable
Default-BB-HostDefinition:
RPC Servers
Default-BB-HostDefinition:
RPC Servers
Default-BB-HostDefinition:
SNMP Servers
Default-BB-HostDefinition:
SNMP Servers
Default-BB-HostDefinition:
SSH Servers
Default-BB-HostDefinition:
SSH Servers
Default-BB-HostDefinition:
Syslog Servers and
Senders
Default-BB-HostDefinition:
Syslog Servers and
Senders
107