Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT REV 1 Manual page 117

Table B-7 Default Building Blocks (continued)
Building Block
Default-BB-Network
Definition: Honeypot like
Addresses
Default-BB-Network
Definition: NAT Address
Range
Default-BB-Network
Definition: Server
Networks
Default-BB-Network
Definition: Undefined IP
Space
Default-BB-Policy:
Application Policy
Violation Events
Default-BB-Policy: IRC/IM
Connection Violations
Default-BB-Policy: Policy
P2P
Default-BB-PortDefinition:
Database Ports
Default-BB-PortDefinition:
DHCP Ports
Default-BB-PortDefinition:
DNS Ports
Default-BB-PortDefinition:
FTP Ports
Default-BB-PortDefinition:
Game Server Ports
Block
Group Type
Network Event Edit this BB by replacing the other
Definition
Network Event Edit this BB to define typical
Definition
Network Event Edit this BB to include the
Definition
Network Event Edit this BB to include areas of
Definition
Policy Event Edit this BB to define policy
Policy Event Edit this BB to define all policy
Policy Event Edit this BB to include all events
Port\ Event Edit this BB to include all common
Protocol
Definition
Port\ Event Edit this BB to include all common
Protocol
Definition
Port\ Event Edit this BB to include all common
Protocol
Definition
Port\ Event Edit this BB to include all common
Protocol
Definition
Port\ Event Edit this BB to include all common
Protocol
Definition
STRM Log Management Users Guide
Description
network with network objects
defined in your network hierarchy
that are currently not in use in your
network or are used in a honeypot
or tarpit installation. Once these
have been defined, you must
enable the Default-Rule-Anomaly:
Potential Honeypot Access rule.
You must also add a
security/policy sentry to these
network objects to generate events
based on attempted access.
Network Address Translation
(NAT) range you wish to use in
your deployment.
networks where your servers are
located.
your network that does not contain
any valid hosts.
application and violation events.
IRC/IM connection violations.
that indicate Peer-to-Peer (P2P)
events.
database ports.
DHCP ports.
DNS ports.
FTP ports.
game server ports.
Default Building Blocks
Associated Building
Blocks, if applicable
111