Juniper 2010.0 STRM Log Manager Security Threat Response Manager Administration Guide

Security Threat Response Manager
STRM Log Manager Administration
Guide
Release 2010.0
Juniper Networks, Inc.
1194 North Mathilda Avenue
Sunnyvale, CA 94089
USA
408-745-2000
www.juniper.net
Published: 2013-01-29
Copyright Notice
Copyright © 2013 Juniper Networks, Inc. All rights reserved.
Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and
other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other trademarks, service marks,
registered trademarks, or registered service marks are the property of their respective owners.
All specifications are subject to change without notice. Juniper Networks assumes no responsibility for any inaccuracies in this document or for any
obligation to update information in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication
without notice.
FCC Statement
The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A
digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the
equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and
used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential
area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following
information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it
is not installed in accordance with NetScreen’s installation instructions, it may cause interference with radio and television reception. This equipment has
been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These
specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that
interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be
determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:
Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/TV
technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.
Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.
Disclaimer
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET
THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE
SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.
STRM Log Manager Administration Guide
Release 2010.0
Copyright © 2013, Juniper Networks, Inc.
All rights reserved. Printed in USA.
Revision History
January 2013— R2 STRM Log Manager Administration Guide
The information in this document is current as of the date listed in the revision history.
2
CONTENTS
ABOUT THIS GUIDE
Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Documentation Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Technical Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Requesting Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1
OVERVIEW
About the Interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Using the Interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Deploying Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Updating User Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
About High Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Monitoring STRM Log Manager Systems with SNMP . . . . . . . . . . . . . . . . . . . . . . . . . 5
2
MANAGING USER ROLES AND ACCOUNTS
Managing Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Viewing Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Creating a Role. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Editing a Role . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Deleting a Role . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Managing User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Creating a User Account. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Editing a User Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Disabling a User Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Authenticating Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Configuring your SSL Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3
MANAGING THE SYSTEM
Managing Your License Keys. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Updating your License Key. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Exporting Your License Key Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Restarting a System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Shutting Down a System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Configuring Access Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Configuring Firewall Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Updating Your Host Set-up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Configuring Interface Roles. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24
Changing Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25
Updating System Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26
4
MANAGING HIGH AVAILABILITY
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33
HA Deployment Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34
HA Clustering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34
Data Storage Strategies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .35
Failovers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .36
Adding an HA Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .37
Editing an HA Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .42
Removing an HA Host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .44
Setting an HA Host Offline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .44
Setting an HA Host Online . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45
Restoring a Failed Host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45
5
SETTING UP STRM LOG MANAGER
Creating Your Network Hierarchy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .47
Best Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .47
Defining Your Network Hierarchy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48
Scheduling Automatic Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .51
Scheduling Automatic Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .52
Updating Your Files On-Demand . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55
Configuring System Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .56
Configuring your IF-MAP Server Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . .64
Using Event Retention Buckets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64
Configuring Event Retention Buckets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .65
Managing Retention Buckets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .68
Configuring System Notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .70
Configuring the Console Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .72
6
MANAGING BACKUP AND RECOVERY
Managing Backup Archives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .77
Viewing Backup Archives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .77
Importing an Archive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .78
Deleting a Backup Archive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .79
Backing Up Your Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .79
Scheduling Your Backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .79
Initiating a Backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .82
Restoring Your Configuration Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .83
Restoring on a System with the Same IP Address . . . . . . . . . . . . . . . . . . . . . . . .83
Restoring to a System with a Different IP Address . . . . . . . . . . . . . . . . . . . . . . . .84
7
USING THE DEPLOYMENT EDITOR
About the Deployment Editor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .88
Accessing the Deployment Editor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Using the Editor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Creating Your Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Before you Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Configuring Deployment Editor Preferences . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Building Your Event View . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Adding Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Connecting Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Forwarding Normalized Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Renaming Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
Managing Your System View . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
Setting Up Managed Hosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Using NAT with STRM Log Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Configuring a Managed Host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Assigning a Component to a Host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Configuring Host Context . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Configuring an Accumulator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Configuring STRM Log Manager Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Configuring an Event Collector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Configuring an Event Processor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Configuring an Off-site Source . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Configuring an Off-site Target . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
8
FORWARDING SYSLOG DATA
Adding a Syslog Destination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Editing a Syslog Destination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
Delete a Syslog Destination. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
A
B
JUNIPER NETWORKS MIB
VIEWING AUDIT LOGS
Logged Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Viewing the Log File. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
C
EVENT CATEGORIES
High-Level Event Categories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
Recon. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
DoS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
Exploit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Malware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Suspicious Activity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
CRE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
Potential Exploit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
SIM Audit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Audit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
INDEX
ABOUT THIS GUIDE
The STRM Log Manager Administration Guide provides you with information for
managing STRM Log Manager functionality requiring administrative access.
Audience
This guide is intended for the system administrator responsible for setting up
STRM Log Manager in your network. This guide assumes that you have STRM
Log Manager administrative access and a knowledge of your corporate network
and networking technologies.
Documentation
Conventions
Table 1 lists conventions that are used throughout this guide.
Table 1 Icons
Icon
Technical
Documentation
Type
Description
Information note
Information that describes important features or
instructions.
Caution
Information that alerts you to potential loss of
data or potential damage to an application,
system, device, or network.
Warning
Information that alerts you to potential personal
injury.
You can access technical documentation, technical notes, and release notes
directly from the Juniper customer support website at
https://www.juniper.net/support/. Once you access the Juniper customer support
website, locate the product and software release for which you require
documentation.
Your comments are important to us. Please send your e-mail comments about this
guide or any of the Juniper Networks documentation to:
[email protected].
Include the following information with your comments:
•
Document title
STRM Log Manager Administration Guide
2
ABOUT THIS GUIDE
•
Requesting
Technical Support
Page number
To help resolve any issues that you may encounter when installing or maintaining
STRM Log Manager, you can contact Customer Support as follows:
•
Open a support case using the Case Management link at
http://www.juniper.net/support
•
Call 1-888-314-JTAC (from the United States, Canada, or Mexico)
or1-408-745-9500 (from elsewhere).
STRM Log Manager Administration Guide
1
OVERVIEW
This chapter provides an overview of the STRM Log Manager administrative
functionality, including:
About the Interface
•
About the Interface
•
Using the Interface
•
Deploying Changes
•
Updating User Details
•
About High Availability
•
Monitoring STRM Log Manager Systems with SNMP
You must have administrative privileges to access the administrative functions. To
access administrative functions, click the Admin tab in the STRM Log Manager
interface. The Admin interface provides access to the following functions.
•
Manage users. See Managing User Roles and Accounts.
•
Manage your network settings. See Managing the System.
•
Manage your High Availability configuration. See Managing High Availability.
•
Manage STRM Log Manager settings. See Setting Up STRM Log Manager.
•
Backup and recover your data. See Managing Backup and Recovery.
•
Manage your deployment views. See Using the Deployment Editor.
•
Configure syslog forwarding. See Forwarding Syslog Data.
•
Manage log sources. For more information, see the Log Sources Users Guide.
All configuration updates using the Admin interface are saved to a staging area.
Once all changes are complete, you can deploy the configuration changes or all
configuration settings to the remainder of your deployment. For more information,
see Deploying Changes.
STRM Log Manager Administration Guide
4
OVERVIEW
Using the Interface
The Admin interface provides several tab and menu options that allow you to
configure STRM Log Manager, including:
•
System Configuration - Provides access to administrative functionality, such
as user management, automatic updates, license key, network hierarchy,
system settings, system notifications, backup and recovery, and Console
configuration.
•
Data Sources - Provides access to log source management, syslog
forwarding, event retention buckets, and custom event properties.
The Admin interface also includes several menu options, including:
Table 1-1 Admin Interface Menu Options
Menu Option
Description
Deployment Editor
Opens the deployment editor
interface.
Deploy Changes
Deploys any configuration changes
from the current session to your
deployment.
Advanced
Deploying Changes
Sub-Menu
Deploy Full
Configuration
Deploys all changes.
Once you update your configuration settings using the Admin interface, you must
save those changes to the staging area. You must either manually deploy all
changes using the Deploy Changes button or, upon exiting the Admin interface, a
window is displayed prompting you to deploy changes before you exit. All
deployed changes are then applied throughout your deployment.
Using the Admin interface menu, you can deploy changes as follows:
•
Advanced > Deploy Full Configuration - Deploys all configuration settings to
your deployment.
•
Deploy Changes - Deploys any configuration changes from the current
session to your deployment.
STRM Log Manager Administration Guide
Updating User Details
Updating User
Details
5
You can access your administrative user details through the main STRM Log
Manager interface. To access your user information, click Preferences. The User
Details window is displayed. You can update your administrative user details, if
required.
NOTE
About High
Availability
For information about the pop-up notifications, see the STRM Log Manager Users
Guide.
The High Availability (HA) feature ensures availability of STRM Log Manager data
in the event of a hardware or network failure. Each HA cluster consists of a primary
host and a standby secondary host. The secondary host maintains the same data
as the primary host by either replicating the data on the primary host or accessing
a shared external storage. At regular intervals, every 10 seconds by default, the
secondary host sends a heartbeat ping to the primary host to detect hardware or
network failure. If the secondary host detects a failure, the secondary host
automatically assumes all responsibilities of the primary host.
NOTE
HA is not supported in an IPv6 environment.
For more information about managing HA clusters, see Chapter 4 - Managing High
Availability.
Monitoring STRM
Log Manager
Systems with
SNMP
STRM Log Manager supports the monitoring of our appliances through SNMP
polling. STRM Log Manager uses the Net-SNMP agent, which supports a variety
of system resource monitoring MIBs that can be polled by Network Management
solutions for the monitoring and alerting of system resources. For more information
on Net-SNMP, refer to Net-SNMP documentation.
STRM Log Manager Administration Guide
2
MANAGING USER ROLES AND
ACCOUNTS
You can manage user accounts for all users that require access to STRM Log
Manager. Each user is associated with a role, which determines the privileges the
user has to functionality and information within STRM Log Manager. You can add
and remove user accounts, and restrict or allow access to certain areas of the
network.
This chapter provides information on managing STRM Log Manager users,
including:
Managing Roles
•
Managing Roles
•
Managing User Accounts
•
Authenticating Users
You must create a role before you can create user accounts. By default, STRM
Log Manager provides a default administrative role, which provides access to all
areas of STRM Log Manager. A user that is assigned administrative privileges
(including the default administrative role) cannot edit their own account. Another
administrative user must make account changes.
This section includes information on managing user roles, including:
Viewing Roles
•
Viewing Roles
•
Creating a Role
•
Editing a Role
•
Deleting a Role
To view roles:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 In the User Management section, click the User Roles icon.
The Manage Roles window is displayed, providing the following information:
STRM Log Manager Administration Guide
8
MANAGING USER ROLES AND ACCOUNTS
Table 2-1 Manage Roles Parameters
Parameter
Description
Role
Specifies the defined user role.
Log Sources
Specifies the log sources you want this role to access.
Note: Log sources are external event log sources such as
security equipment (for example, firewalls and IDSs) and
network equipment (for example, switches and routers).
This allows you to restrict or grant access for users assigned
to the role to view log and event data received from assigned
security and network log sources or log source groups.
For non-administrative users, this column indicates a link
that allows an administrative user to edit the permissions for
the role. For more information on editing a user role, see
Editing a Role.
To view the list of log sources that have been assigned to
this role, move your mouse over the text in the Log Sources
column.
Creating a Role
Associated Users
Specifies the users associated with this role.
Action
Allows you to edit or delete the user role.
To create a role:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the User Roles icon.
The Manage Roles window is displayed.
Step 4 Click Create Role.
The Manage Role Permissions window is displayed.
Step 5 Enter values for the parameters. You must select at least one permission to
proceed.
Table 2-2 Create Roles Parameters
Parameter
Description
Role Name
Type the unique name of the role. The name can be up to 15
characters in length and must only contain integers and
letters.
STRM Log Manager Administration Guide
Managing Roles
9
Table 2-2 Create Roles Parameters (continued)
Parameter
Description
Admin
Select this check box if you want to grant this user
administrative access to the STRM Log Manager interface.
Once you select the Admin check box, all administrative
access check boxes are selected by default. Within the
Admin role, you can grant individual access to the following:
Log Activity
•
Administrator Manager - Select this check box if you
want to allow users the ability to create and edit other
administrative user accounts. If you select this check box,
the System Administrator check box is automatically
selected.
•
System Administrator - Select this check box if you want
to allow users access to all areas of STRM Log Manager.
Users with this access are not able to edit other
administrator accounts.
Select this check box if you want this user to have access to
all Log Activity interface functionality. Within the Log Activity
role, you can also grant users individual access to the
following:
•
Manage Time Series - Select this check box if you want to
allow users the ability to configure and view time series
data charts.
•
Customized Rule Creation - Select this check box if you
want to allow users to create rules using the Log Activity
interface.
•
User Defined Event Properties - Select this check box if
you want to allow users the ability to create custom event
properties. For more information about custom event
properties, see the STRM Log Manager Users Guide.
For more information on the Log Activity interface, see the
STRM Log Manager Users Guide.
Reports
Select this check box if you want to grant this user access to
all Reports interface functionality. Within the Reports role,
you can grant users individual access to the following:
•
Maintain Templates - Select this check box if you want to
allow users to maintain reporting templates.
•
Distribute Reports via Email - Select this check box if
you want to allow users to distribute reports through email.
For more information, see the STRM Log Manager Users
Guide.
IP Right Click Menu
Extensions
Select the check box if you want to grant this user access to
options added to right-click menu.
Step 6 Click Next.
Step 7 Choose one of the following options:
STRM Log Manager Administration Guide
10
MANAGING USER ROLES AND ACCOUNTS
a
If you selected a role that includes the Log Activity permissions role, go to Step
8.
b
If you selected a role that does not include the Log Activity permissions, go to
Step 9.
The Add Log Sources to User Role window is displayed.
Step 8 Select the log sources you want to add to the user role:
a
Using the Log Source Group drop-down list box, select a log source group.
b From the Log Source list, locate and select the log source(s) you want the user
assigned to this role to have access to.
NOTE
You can add an entire log source group by clicking the
icon in the Log
Source Group section. To select multiple log sources, hold the Ctrl key while you
select each log source you want to add.
c
Click the
icon.
The selected log source(s) moves to the Selected Log Source Objects field.
Step 9 Click Next.
A confirmation message is displayed.
Step 10 Click Return.
Step 11 Close the Manage Roles window.
The Admin interface is displayed.
Step 12 From the Admin interface toolbar, click Deploy Changes.
Editing a Role
To edit a role:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 In the User Management section, click the User Roles icon.
The Manage Roles window is displayed.
Step 4 For the role you want to edit, click the edit icon
.
The Manage Role Permissions window is displayed.
Step 5 Update the permissions (see Table 2-3), as necessary.
Step 6 Click Next.
Step 7 Choose one of the following options:
a
If you selected a role that includes the Log Activity permissions role, go to Step
8.
STRM Log Manager Administration Guide
Managing User Accounts
b
11
If you selected a role that does not include the Log Activity permissions, go to
Step 11.
The Add Log Sources to User Role window is displayed.
Step 8 Update log source permissions, as desired:
a
To remove a log source permission, select the log source(s) in the Selected
Log Source Objects panel that you want to remove. Click Remove Selected
Log Sources.
b
To add a log source permission, select an object you want to add from the left
panel.
Step 9 Repeat for all log sources you want to edit for this role.
Step 10 Click Next.
Step 11 Click Return.
Step 12 Close the Manage User Roles window.
The Admin interface is displayed.
Step 13 From the Admin interface menu, click Deploy Changes.
Deleting a Role
To delete a role:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 In the User Management section, click the User Roles icon.
The Manage Role window is displayed.
Step 4 For the role you want to delete, click the delete icon
.
A confirmation window is displayed.
Step 5 Click OK.
Step 6 Close the Manage User Roles window.
The Admin interface is displayed.
Step 7 From the Admin interface menu, click Deploy Changes.
Managing User
Accounts
You can create a STRM Log Manager user account, which allows a user access to
selected network components using the STRM Log Manager interface. You can
also create multiple accounts for your system that include administrative privileges.
Only the main administrative account can create accounts that have administrative
privileges.
You can create and edit user accounts to access STRM Log Manager, including:
•
Creating a User Account
•
Editing a User Account
STRM Log Manager Administration Guide
12
MANAGING USER ROLES AND ACCOUNTS
•
Creating a User
Account
Disabling a User Account
To create an account for a STRM Log Manager user:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the Users icon.
The Manage Users window is displayed.
Step 4 In the Manage Users section, click Add.
The User Details window is displayed.
Step 5 Enter values for the following parameters:
Table 2-3 User Details Parameters
Parameter
Description
Username
Type a unique username for the new user. The username must
not include spaces or special characters.
Password
Type a password for the user to gain access. The password must
be at least five characters in length.
Confirm Password Type the password again for confirmation.
Email Address
Type the user’s email address.
Role
Using the drop-down list box, select the role you want this user to
assume. For information on roles, see Managing Roles. If you
select Admin, this process is complete.
Step 6 Click Next.
Step 7 Choose one of the following options:
a
If you selected Admin as the user role, go to Step 10.
b
If you selected a non-administrative user role, go to Step 8.
The Selected Network Objects window is displayed.
Step 8 From the menu tree, select the network objects you want this user to be able to
monitor.
The selected network objects are displayed in the Selected Network Objects
panel.
Step 9 Click Finish.
Step 10 Close the Manage Users window.
The Admin interface is displayed.
STRM Log Manager Administration Guide
Managing User Accounts
Editing a User
Account
13
To edit a user account:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the Users icon.
The Manage Users window is displayed.
Step 4 In the Manage Users section, click the name of the user account you want to edit.
The User Details window is displayed.
Step 5 Update values (see Table 2-3), as necessary.
Step 6 Click Next.
If you are editing a non-administrative user account, the Selected Network Objects
window is displayed. If you are editing an administrative user account, go to Step
10.
Step 7 From the menu tree, select the network objects you want this user to access.
The selected network objects are displayed in the Selected Network Object
panel.
Step 8 For all network objects you want to remove access, select the object from the
Selected Network Objects panel. Click Remove.
Step 9 Click Finish.
Step 10 Close the Manage Users window.
The Admin interface is displayed.
Disabling a User
Account
To disable a user account:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the Users icon.
The Manage Users window is displayed.
Step 4 In the Manage Users section, click the user account you want to disable.
The User Details window is displayed.
Step 5 In the Role drop-down list box, select Disabled.
Step 6 Click Next.
Step 7 Close the Manage Users window.
STRM Log Manager Administration Guide
14
MANAGING USER ROLES AND ACCOUNTS
The Admin interface is displayed. This user no longer has access to the STRM Log
Manager interface. If this user attempts to log in to STRM Log Manager, the
following message is displayed: This account has been disabled.
After you delete a user, items, such as saved searches and reports, remain
associated with the deleted user.
Authenticating
Users
You can configure authentication to validate STRM Log Manager users and
passwords. STRM Log Manager supports the following user authentication types:
•
System Authentication - Users are authenticated locally by STRM Log
Manager. This is the default authentication type.
•
RADIUS Authentication - Users are authenticated by a Remote Authentication
Dial-in User Service (RADIUS) server. When a user attempts to log in, STRM
Log Manager encrypts the password only, and forwards the username and
password to the RADIUS server for authentication.
•
TACACS Authentication - Users are authenticated by a Terminal Access
Controller Access Control System (TACACS) server. When a user attempts to
log in, STRM Log Manager encrypts the username and password, and forwards
this information to the TACACS server for authentication.
•
Active Directory - Users are authenticated by a Lightweight Directory Access
Protocol (LDAP) server using Kerberos.
•
LDAP - Users are authenticated by a Native LDAP server.
If you want to configure RADIUS, TACACS, Active Directory, or LDAP as the
authentication type, you must:
•
Configure the authentication server before you configure authentication in
STRM Log Manager.
•
Make sure the server has the appropriate user accounts and privilege levels to
communicate with STRM Log Manager. See your server documentation for
more information.
•
Make sure the time of the authentication server is synchronized with the time of
the STRM Log Manager server. For more information on setting STRM Log
Manager time, see Chapter 5 - Setting Up STRM Log Manager.
•
Make sure all users have appropriate user accounts and roles in STRM Log
Manager to allow authentication with the third-party servers.
Once authentication is configured and a user enters an invalid username and
password combination, a message is displayed indicating the login was invalid. If
the user attempts to access the system multiple times using invalid information, the
user must wait the configured amount of time before attempting to access the
system again. For more information on configuring system settings for
authentication, see Chapter 5 -Setting Up STRM Log Manager - Configuring the
Console Settings.
STRM Log Manager Administration Guide
Authenticating Users
15
An administrative user can access STRM Log Manager through third-party
authentication or the STRM Log Manager Admin password. The STRM Log
Manager Admin password will still function if you have setup and activated a
third-party authentication module, however, you can not change the STRM Log
Manager Admin password while the authentication module is active. If you want to
change the STRM Log Manager admin password, you need to temporarily disable
the third-party authentication module, reset the password, and then reconfigure the
third-party authentication module.
To configure authentication:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the Authentication icon.
The Authentication window is displayed.
Step 4 From the Authentication Module drop-down list box, select the authentication
type you want to configure.
Step 5 Configure the selected authentication type:
a
If you selected System Authentication, go to Step 6
b
If you selected RADIUS Authentication, enter values for the following
parameters:
Table 2-4 RADIUS Parameters
Parameter
Description
RADIUS Server
Type the hostname or IP address of the RADIUS server.
RADIUS Port
Type the port of the RADIUS server.
Authentication
Type
Type the type of authentication you want to perform. The options
are:
Shared Secret
c
•
CHAP (Challenge Handshake Authentication Protocol) Establishes a Point-to-Point Protocol (PPP) connection
between the user and the server.
•
MSCHAP (Microsoft Challenge Handshake Authentication
Protocol) - Authenticates remote Windows workstations.
•
ARAP (Apple Remote Access Protocol) - Establishes
authentication for AppleTalk network traffic.
•
PAP (Password Authentication Protocol) - Sends clear text
between the user and the server.
Type the shared secret that STRM Log Manager uses to encrypt
RADIUS passwords for transmission to the RADIUS server.
If you selected TACACS Authentication, enter values for the following
parameters:
STRM Log Manager Administration Guide
16
MANAGING USER ROLES AND ACCOUNTS
Table 2-5 TACACS Parameters
Parameter
Description
TACACS Server
Type the hostname or IP address of the TACACS server.
TACACS Port
Type the port of the TACACS server.
Authentication
Type
From drop down list box, select the type of authentication you
want to perform. The options are:
Shared Secret
d
•
ASCII
•
PAP (Password Authentication Protocol) - Sends clear text
between the user and the server.
•
CHAP (Challenge Handshake Authentication Protocol) Establishes a PPP connection between the user and the
server.
•
MSCHAP (Microsoft Challenge Handshake Authentication
Protocol) - Authenticates remote Windows workstations.
•
MSCHAP2 - (Microsoft Challenge Handshake Authentication
Protocol version 2) - Authenticates remote Windows
workstations using mutual authentication.
•
EAPMD5 (Extensible Authentication Protocol using MD5
Protocol) - Uses MD5 to establish a PPP connection.
Type the shared secret that STRM Log Manager uses to encrypt
TACACS passwords for transmission to the TACACS server.
If you selected Active Directory, enter values for the following parameters:
Table 2-6
Active Directory Parameters
Parameter
Description
Server URL
Type the URL used to connect to the LDAP server. For example,
ldap://<host>:<port>
LDAP Context
Type the LDAP context you want to use, for example,
DC=Q1LABS,DC=INC.
LDAP Domain
Type the domain you want to use, for example q1labs.inc
e
If you selected LDAP, enter values for the following parameters:
Table 2-7 LDAP Parameters
Parameter
Description
Server URL
Type the URL used to connect to the LDAP server. For example,
ldap://<host>:<port>
You can use a space-separated list to specify multiple LDAP
servers.
STRM Log Manager Administration Guide
Authenticating Users
17
Table 2-7 LDAP Parameters (continued)
Parameter
Description
SSL Connection
From the drop-down list box, select True if you want to use
Secure Socket Layer (SSL) encryption when connecting to the
LDAP server. The default is True.
Before enabling the SSL connection to your LDAP server, you
must copy the SSL certificate from the LDAP server to the
/opt/qradar/conf/trusted_certificates/ directory on your STRM Log
Manager system. For more information on how to configure the
SSL certificate, see Configuring your SSL Certificate.
TLS
Authentication
From the drop-down list box, select True if you want to start
Transport Layer Security (TLS) encryption when connecting to
the LDAP server. The default is True.
Search Entire
Base
From the drop-down list box, select one of the following options:
•
True - Enables searching all subdirectories of the specified
Directory Name (DN).
•
False - Enables searching the immediate contents of the Base
DN. The subdirectories are not searched.
The default is True.
LDAP User Field
Type the user field identifier you want to search on, for example,
uid. You can use a comma-separated list to search for multiple
user identifiers.
Base DN
Type the base DN for performing searches, for example,
DC=Q1LABS,DC=INC.
Step 6 Click Save.
Your authentication is now configured.
Configuring your SSL
Certificate
If you use LDAP for user authentication and you want to enable SSL, you must
configure your SSL certificate.
To configure your SSL certificate for connection to your LDAP server:
Step 1 Log in to STRM Log Manager as root.
Step 2 Type the following command to create the /opt/qradar/conf/trusted_certificates/
directory:
mkdir -p /opt/qradar/conf/trusted_certificates
Step 3 Copy the SSL certificate from the LDAP server to the
/opt/qradar/conf/trusted_certificates/ directory on your STRM Log Manager
system.
Step 4 Verify that the certificate file name extension is .cert, which indicates that the
certificate is trusted. STRM Log Manager only loads .cert files.
Step 5 Change the permissions of the directory by typing the following commands:
chmod 755 /opt/qradar/conf/trusted_certificates
STRM Log Manager Administration Guide
18
MANAGING USER ROLES AND ACCOUNTS
chmod 644 /opt/qradar/conf/trusted_certificates/*.cert
Step 6 Type the following command to restart the Tomcat service:
service tomcat restart
STRM Log Manager Administration Guide
3
MANAGING THE SYSTEM
This chapter provides information for managing your system, including:
Managing Your
License Keys
•
Managing Your License Keys
•
Restarting a System
•
Shutting Down a System
•
Configuring Access Settings
For your STRM Log Manager Console, a default license key provides you access
to the interface for 5 weeks. You must manage your license key using the System
and License Management window, which you can access using the Admin
interface. This window provides the status of the license key for each system
(host) in your deployment. Statuses include:
•
Valid - The license key is valid.
•
Expired - The license key has expired. To update your license key, see
Updating your License Key.
•
Override Console License - This host is using the Console license key. You
can use the Console key or apply a license key for this system. If you want to
use the Console license for any system in your deployment, click Revert to
Console in the Manage License window.
A license key allows a certain number of log sources to be configured in your
system. If you exceed the limit of configured logs sources, as established by the
license key, an error message is displayed in the interface. If additional log sources
are auto-discovered, they are automatically disabled. To extend the number of log
sources allowed, contact your sales representative.
This section provides information on managing your license keys, including:
•
Updating your License Key
•
Exporting Your License Key Information
STRM Log Manager Administration Guide
20
MANAGING THE SYSTEM
Updating your
License Key
For your STRM Risk Manager Console, a default license key provides you access
to the interface for 5 weeks. Choose one of the following options for assistance
with your license key:
•
For a new or updated license key, contact your local sales representative.
•
For all other technical issues, please contact Juniper Networks Customer
Support.
If you log in to STRM Log Manager and your Console license key has expired, you
are automatically directed to the System and License Management window. You
must update the license key before you can continue. However, if one of your
non-Console systems includes an expired license key, a message is displayed
when you log in indicating a system requires a new license key. You must navigate
to the System and License Management window to update that license key.
To update your license key:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the System and License Management icon.
The System and License Management window is displayed, providing a list of all
hosts in your deployment.
Step 4 Select the host for which you want to view the license key.
Step 5 From the Actions menu, select Manage License.
The Current License Details window is displayed, providing the current license key
limits. If you want to obtain additional licensing capabilities, please contact your
sales representative.
Step 6 Click Browse beside the New License Key File and select the license key.
Step 7 Click Open.
The Current License Details window is displayed.
Step 8 Click Save.
Step 9 In the System and License Management window, click Deploy License Key.
NOTE
If you want to revert back to the previous license key, click Revert to Deployed. If
you revert to the license key used by the STRM Log Manager Console system,
click Revert to Console.
The license key information is updated in your deployment.
STRM Log Manager Administration Guide
Restarting a System
Exporting Your
License Key
Information
21
To export your license key information for all systems in your deployment:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the System and License Management icon.
The System and License Management window is displayed, providing a list of all
hosts in your deployment.
Step 4 In the Actions menu, click Export Licenses.
The export window is displayed.
Step 5 Select one of the following options:
•
Open - Opens the license key data using the selected application.
•
Save - Allows you to save the file to your desktop.
Step 6 Click OK.
Restarting a
System
To restart a STRM Log Manager system:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the System and License Management icon.
The System and License Management window is displayed.
Step 4 Select the system you want to restart.
Step 5 From the Actions menu, select Restart System.
NOTE
Shutting Down a
System
Data collection stops while the system is shutting down and restarting.
To shutdown a STRM Log Manager system:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the System and License Management icon.
STRM Log Manager Administration Guide
22
MANAGING THE SYSTEM
The System and License Management window is displayed.
Step 4 Select the system you want to shut down.
Step 5 From the Actions menu, select Shutdown.
NOTE
Configuring
Access Settings
Data collection stops while the system is shutting down.
The System and License Management window provides access to the web-based
system administration interface, which allows you to configure firewall rules,
interface roles, passwords, and system time.
This section provides information on configuring access settings, including:
Configuring Firewall
Access
•
Configuring Firewall Access
•
Updating Your Host Set-up
•
Configuring Interface Roles
•
Changing Passwords
•
Updating System Time
You can configure local firewall access to enable communications between
devices and STRM Log Manager. Also, you can define access to the web-based
system administration interface.
To enable STRM Log Manager managed hosts to access specific devices or
interfaces:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the System and License Management icon.
The System and License Management window is displayed.
Step 4 Select the host for which you want to configure firewall access settings.
Step 5 From the Actions menu, select Manage System.
Step 6 Log in to the System Administration interface. The default is:
Username: root
Password: <your root password>
STRM Log Manager Administration Guide
Configuring Access Settings
NOTE
23
The username and password are case sensitive.
Step 7 From the menu, select Managed Host Config > Local Firewall.
The Local Firewall window is displayed.
Step 8 In the Device Access box, you must include any STRM Log Manager systems
you want to have access to this managed host. Only listed managed hosts have
access. For example, if you type one IP address, only that one IP address will be
granted access to the managed host. All other managed hosts are blocked.
To configure access:
a
In the IP Address field, type the IP address of the managed host you want to
have access.
b
From the Protocol list box, select the protocol you want to enable access for
the specified IP address and port. Options include:
-
UDP - Allows UDP traffic.
-
TCP - Allows TCP traffic.
-
Any - Allows any traffic.
c
In the Port field, type the port on which you want to enable communications.
d
Click Allow.
Step 9 In the System Administration Web Control section, type the IP address(es) of
managed host(s) that you want to allow access to the web-based system
administration interface in the IP Address field. Only IP addresses listed have
access to the interface. If you leave the field blank, all IP addresses will have
access. Click Allow.
NOTE
Make sure you include the IP address of your client desktop you want to use to
access the interface. Failing to do so may affect connectivity.
Step 10 Click Apply Access Controls.
Step 11 Wait for the interface to refresh before continuing.
Updating Your Host
Set-up
You can use the web-based system administration interface to configure the mail
server you want STRM Log Manager to use and the global password for STRM
Log Manager configuration:
To configure your host set-up:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the System and License Management icon.
STRM Log Manager Administration Guide
24
MANAGING THE SYSTEM
The System and License Management window is displayed.
Step 4 Select the host for which you want to update your host setup settings.
Step 5 From the Actions menu, select Manage System.
Step 6 Log in to the System Administration interface. The default is:
Username: root
Password: <your root password>
NOTE
The username and password are case sensitive.
Step 7 From the menu, select Managed Host Config > STRM Log Manager Setup.
The STRM Log Manager Setup window is displayed.
Step 8 In the Mail Server field, type the address for the mail server you want STRM Log
Manager to use. STRM Log Manager uses this mail server to distribute alerts and
event messages. To use the mail server provided with STRM Log Manager, type
localhost.
Step 9 In the Enter the global configuration password, type the password you want to
use to access the host. Type the password again for confirmation.
NOTE
The global configuration password must be the same throughout your
deployment. If you edit this password, you must also edit the global configuration
password on all systems in your deployment.
Step 10 Click Apply Configuration.
Configuring Interface
Roles
You can assign specific roles to the network interfaces on each managed host.
To assign roles:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the System and License Management icon.
The System and License Management window is displayed.
Step 4 Select the host for which you want to configure interface roles.
Step 5 From the Actions menu, select Manage System.
Step 6 Log in to the System Administration interface. The default is:
Username: root
STRM Log Manager Administration Guide
Configuring Access Settings
25
Password: <your root password>
NOTE
The username and password are case sensitive.
Step 7 From the menu, select Managed Host Config > Network Interfaces.
The Network Interfaces window is displayed, including a list of each interface on
your managed host.
NOTE
For assistance with determining the appropriate role for each interface, please
contact Juniper Networks Customer Support.
Step 8 For each interface listed, select the role you want to assign to the interface using
the Role list box.
Step 9 Click Save Configuration.
Step 10 Wait for the interface to refresh before continuing.
Changing Passwords
To change the passwords:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the System and License Management icon.
The System and License Management window is displayed.
Step 4 Select the host for which you want to change passwords.
Step 5 From the Actions menu, select Manage System.
Step 6 Log in to the System Administration interface. The default is:
Username: root
Password: <your root password>
NOTE
The username and password are case sensitive.
Step 7 From the menu, select Managed Host Config > Root Password.
The Root Passwords window is displayed.
Step 8 Update the passwords and confirm:
STRM Log Manager Administration Guide
26
MANAGING THE SYSTEM
NOTE
Make sure you record the entered values.
•
New Root Password - Type the root password necessary to access the
web-based system administration interface.
•
Confirm New Root Password - Type the password again for confirmation.
Step 9 Click Update Password.
Updating System
Time
You are able to change the time for the following options:
•
System time
•
Hardware time
•
Time Zone
•
Time Server
NOTE
All system time changes must be made within the System Time window. You can
only change the system time information on the host operating the Console. The
change is then distributed to all managed hosts in your deployment.
You can configure time for your system using one of the following methods:
•
Configuring Your Time Server Using RDATE
•
Manually Configuring Time Settings For Your System
Configuring Your Time Server Using RDATE
To update the time settings using RDATE:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the System and License Management icon.
The System and License Management window is displayed.
Step 4 Select the host for which you want to configure system time settings.
Step 5 From the Actions menu, select Manage System.
Step 6 Log in to the System Administration interface. The default is:
Username: root
Password: <your root password>
STRM Log Manager Administration Guide
Configuring Access Settings
NOTE
27
The username and password are case sensitive.
Step 7 From the menu, select Managed Host Config > System Time.
The System Time window is displayed.
Step 8 Configure the time zone:
a
Click Change time zone.
The Time Zone window is displayed.
b
From the Change timezone to drop-down list box, select the time zone in
which this managed host is located.
c
Click Save.
Step 9 Configure the time server:
a
Click Time server sync.
The Time Server window is displayed.
b
Configure the following parameters:
Table 3-1 Time Server Parameters
Parameter
Description
Timeserver hostnames or
addresses
Type the time server hostname or IP address.
Set hardware time too
Select the check box if you want to set the hardware
time.
Synchronize on schedule?
Select one of the following options:
•
No - Select this option if you do not want to
synchronize the time. Go to c.
•
Yes - Select this option if you want to synchronize
the time.
Simple Schedule
Select this option if you want the time update to
occur at a specific time. Once you select this option,
select a simple schedule from the drop-down list
box.
Times and dates are selected
below
Select this option the time you want the time update
to occur. Once you select this option, select the
times and dates in the list boxes.
c
Click Sync and Apply.
Manually Configuring Time Settings For Your System
To update the time settings for your system:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
STRM Log Manager Administration Guide
28
MANAGING THE SYSTEM
The System Configuration panel is displayed.
Step 3 Click the System and License Management icon.
The System and License Management window is displayed.
Step 4 Select the host for which you want to configure system time settings.
Step 5 From the Actions menu, select Manage System.
Step 6 Log in to the System Administration interface. The default is:
Username: root
Password: <your root password>
NOTE
The username and password are case sensitive.
Step 7 From the menu, select Managed Host Config > System Time.
The System Time window is displayed.
NOTE
The time settings window is divided into two sections. You must save each setting
before continuing. For example, when you configure System Time, you must click
Apply within the System Time section before continuing.
Step 8 Click Set time.
Step 9 Set the system time:
a
b
Choose one of the following options:
-
In the System Time panel, using the drop-down list boxes, select the current
date and time you want to assign to the managed host.
-
Click Set system time to hardware time.
Click Apply.
The Hardware Time window is displayed.
Step 10 Set the hardware time:
a
b
Choose one of the following options:
-
In the Hardware Time panel, using the drop-down list boxes, select the
current date and time you want to assign to the managed host.
-
Click Set hardware time to system time.
Click Save.
Step 11 Configure the time zone:
a
Click Change time zone.
The Time Zone window is displayed.
STRM Log Manager Administration Guide
Configuring Access Settings
29
b
Using the Change Timezone to drop-down list box, select the time zone in
which this managed host is located.
c
Click Save.
STRM Log Manager Administration Guide
30
MANAGING THE SYSTEM
STRM Log Manager Administration Guide
4J uniper customer
support
MANAGING HIGH AVAILABILITY
The High Availawww.juniper.net/support/bility (HA) feature ensures STRM Log
Manager data remains available in the event of a hardware or network failure. To
achieve HA, STRM Log Manager pairs a primary appliance with a secondary HA
appliance to create an HA cluster. The HA cluster uses several monitoring
functions, such as a heartbeat ping between the primary and secondary
appliances, and network connectivity monitoring to other appliances in the STRM
Log Manager deployment. The secondary host maintains the same data as the
primary host by one of two methods: data synchronization between the primary
and secondary appliances or shared external storage. If the secondary host
detects a failure, the secondary host automatically assumes all responsibilities of
the primary host.
Scenarios that cause failover include:
NOTE
•
Network failure, as detected by network connectivity testing
•
Management interface failure on the primary host
•
Complete Redundant Array of Independent Disks (RAID) failure on the primary
host
•
Power supply failure
•
Operating system malfunction that delays or stops the heartbeat ping
Heartbeat messages do not monitor specific STRM Log Manager processes.
STRM Log Manager Administration Guide
32
MANAGING HIGH AVAILABILITY
NOTE
You can manually force a failover from a primary host to a secondary host. This is
useful for planned maintenance on the primary host. For more information on
manually forcing a failover, see Setting an HA Host Offline.
STRM Log Manager Administration Guide
Before You Begin
33
This chapter provides information for configuring and managing HA, including:
Before You Begin
•
Before You Begin
•
HA Deployment Overview
•
Adding an HA Cluster
•
Editing an HA Cluster
•
Setting an HA Host Offline
•
Setting an HA Host Online
•
Restoring a Failed Host
Before adding an HA cluster, confirm the following:
NOTE
For more information on HA concepts, such as HA clustering and data storage
strategies, see HA Deployment Overview.
•
If you plan to enable disk replication (see Disk Synchronization), we require
that the connection between the primary host and secondary host have a
minimum bandwidth of 1 gigabits per second (Gbps).
•
Virtual LAN (VLAN) routing, which divides a physical network into multiple
subnets, is not recommended.
•
The secondary host is located on the same subnet as the primary host.
•
The new primary host IP address is set up on the same subnet.
•
The management interface only supports one Cluster Virtual IP address.
Multihoming is not supported.
•
The secondary host you want to add must have a valid HA activation key.
•
The secondary host must use the same management interface specified as the
primary host. For example, if the primary host uses ETH0 as the management
interface, the secondary host must also use ETH0.
•
The secondary host you want to add must not already be a component in
another HA cluster.
•
The primary and secondary host must have the same STRM Log Manager
software version and patch level installed.
•
If you plan to share storage (see Shared Storage), the secondary host must be
configured with the same external iSCSI devices (if any) as the primary host.
For more information on configuring iSCSI, see the Configuring iSCSI Technical
Note.
•
We recommend that you backup your configuration information and data on all
hosts you intend to configure for HA. For more information on backing up your
configuration information and data, see Managing Backup and Recovery.
STRM Log Manager Administration Guide
34
MANAGING HIGH AVAILABILITY
NOTE
HA Deployment
Overview
HA Clustering
Disk replication is not enabled by default on QFlow Collectors and is not required
for successful failover.
This overview includes information on the key HA deployment concepts, including:
•
HA Clustering
•
Data Storage Strategies
•
Failovers
An HA cluster consists of the following:
•
Primary host - The primary host is the host for which you want to configure HA.
You can configure HA for any system (Console or non-Console) in your
deployment. When you configure HA, the IP address of the primary host
automatically becomes the Cluster Virtual IP address; therefore, you must
configure a new IP address for the primary host.
•
Secondary host - The secondary host is the standby for the primary host. If the
primary host fails, the secondary host automatically assumes all responsibilities
of the primary host.
•
Cluster Virtual IP address - When you configure HA, the current IP address of
the primary host automatically becomes the Cluster Virtual IP address and you
must assign a new IP address to the primary host. In the event that the primary
host fails, the Cluster Virtual IP address is assumed by the secondary host.
STRM Log Manager uses the primary host’s IP address as the Cluster Virtual
IP address to allow other hosts in your deployment to continue communicating
with the HA cluster without requiring you to reconfigure the hosts to send data
to a new IP address.
In the following figure, for example, the current IP address of the primary host is
10.100.1.1 and the IP address of the secondary host is 10.100.1.2.
When configured as an HA cluster, the current primary host IP address
(10.100.1.1) automatically becomes the Cluster Virtual IP address. A new IP
STRM Log Manager Administration Guide
HA Deployment Overview
35
address must be assigned to the primary host. In this example, the assigned IP
address for the primary host is 10.100.1.3.
NOTE
Data Storage
Strategies
You can view the IP addresses for the HA cluster by pointing your mouse over the
Host Name field in the System and License Management window.
STRM Log Manager provides the following data storage strategies in an HA
deployment:
•
Disk Synchronization
•
Shared Storage
Disk Synchronization
The hosts in an HA cluster must have access to the same data on the /store
partition. When you install your secondary host and apply an HA license key, a
/store partition is automatically installed and configured on the host. Once an HA
cluster is configured with the Disable Disk Replication option cleared (default)
and the /store partition is not mounted externally, data in the active host’s /store
partition is automatically replicated to the standby host’s /store partition using a
disk synchronization system.
When you initially add an HA cluster, the first disk synchronization can take an
extended period of time to complete, depending on size of your /store partition and
your disk synchronization speed. For example, the initial disk synchronization can
take an extended period of time, up to 24 hours or more, depending on your
deployment. We require that the connection between the primary host and
secondary host have a minimum bandwidth of 1 gigabits per second (Gbps). The
STRM Log Manager Administration Guide
36
MANAGING HIGH AVAILABILITY
secondary host only assumes the Standby status after the initial disk
synchronization is complete.
When the primary host fails over and the secondary host becomes the Active host,
the secondary host continues to read and write data on the /store partition. When
the primary host is restored, the two /store partitions are no longer synchronized.
Therefore, before the primary host can resume the Active state, disk replication
automatically occurs. When disk replication is complete, the primary host is set to
the Offline state and you must manually set the primary host to the Online state.
The period of time to perform the post-failover disk synchronization is considerably
less than the initial disk synchronization, unless the disk on the primary host disk
was replaced or reformatted when the host was manually repaired.
Shared Storage
If the primary host has the /store partition mounted on an external storage device,
the secondary host must also have the /store partition mounted on the same
external storage device.
CAUTION
You must configure the external storage on the secondary host before configuring
the HA cluster. For more information on configuring external storage, see the
Configuring iSCSI Technical Note.
If the primary and secondary host access the shared storage at the same time,
data corruption can occur. Before a failover occurs, the secondary host determines
if the primary host is still accessing the shared storage. If the secondary host
detects the primary host is still reading and writing to the shared storage, failover
cannot occur. The secondary host is automatically set to the Offline state.
CAUTION
If your primary host and secondary hosts are geographically isolated, failover
may still occur while the primary host is reading or writing to the shared storage.
Failovers
When the primary host fails over, the secondary host performs the following
actions in sequence:
1 Mounts any external shared storage devices, if required.
2 Creates a network alias for the management interface. For example, the network
alias for eth0 is eth0:0.
3 Assigns the Cluster Virtual IP address to the network alias.
4 Starts all STRM Log Manager services.
5 Connects to the Console and downloads configuration files.
This section includes information on general failover scenarios, including:
STRM Log Manager Administration Guide
Adding an HA Cluster
•
Primary Network Failure
•
Primary Disk Failure
•
Secondary Network or Disk Failure
37
Primary Network Failure
The primary host automatically pings all other managed hosts to test it’s network
connection. If the primary host loses network connectivity to a managed host and
the connection to the secondary host is still intact, the primary host requests the
secondary host to verify that it has full connectivity to other managed hosts in the
deployment. The secondary host performs a network connectivity test, testing all
hosts specified in the Advanced Settings of the HA wizard, (Table 4-2). If the test
succeeds, the primary host performs a controlled shutdown and fails over to the
secondary host. This prevents the primary host failover to a secondary host that is
also experiencing network connectivity problems.
Primary Disk Failure
An HA cluster configured with disk replication monitors disks on which the /store
partition is mounted. If RAID completely fails and all disks are unavailable, the
primary host performs shuts down and fails over to the secondary host.
Secondary Network or Disk Failure
If the primary host detects that the secondary host has failed, the primary host
generates an event to notify you that the secondary host is no longer providing HA
protection.
Adding an HA
Cluster
The System and License Management window allows you to manage your HA
clusters
To add an HA cluster:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the System and License Management icon.
The System and License Management window is displayed.
Step 4 Select the host for which you want to configure HA.
Step 5 From the Actions menu, select Add HA Host.
NOTE
If the primary host is a Console, a warning message is displayed to indicate that
the user interface restarts after you add the HA host. Click OK to proceed.
The HA Wizard is displayed.
STRM Log Manager Administration Guide
38
MANAGING HIGH AVAILABILITY
NOTE
If you do not want to view the Welcome to the High Availability window again,
select the Skip this page when running the High Availability wizard check
box.
Step 6 Read the introductory text. Click Next.
The Select the High Availability Wizard Options window is displayed, automatically
displaying the Cluster Virtual IP address, which is the IP address of the primary
host (Host IP).
Step 7 To configure the HA host information, configure the following parameters:
Table 4-1 HA Host Information Parameters
Parameter
Description
Primary Host IP Address
Type a new primary host IP address. The new
primary host IP address is assigned to the primary
host, replacing the previous IP address. The current
IP address of the primary host becomes the Cluster
Virtual IP address.
If the primary host fails and the secondary host
becomes active, the Cluster Virtual IP address is
assigned to the secondary host.
Note: The new primary host IP address must be on
the same subnet as the Host IP.
Secondary Host IP Address
Type the IP address of the secondary host you want
to add. The secondary host must be in the same
subnet as the primary host.
Enter the root password of the
host
Type the root password for the secondary host. The
password must not include special characters.
Confirm the root password of
the host
Type the root password for the secondary host again
for confirmation.
Step 8 Optional. To configure advanced parameters:
a
Click the arrow beside Show Advanced Options.
The advanced option parameters are displayed.
b
Configure the following parameters:
STRM Log Manager Administration Guide
Adding an HA Cluster
39
Table 4-2 Advanced Options Parameters
Parameter
Description
Heartbeat Intervals (seconds)
Type the time, in seconds, you want to elapse
between heartbeat messages. The default is 10
seconds.
At the specified interval, the secondary host sends a
heartbeat ping to the primary host to detect
hardware and network failure.
For more information on failover scenarios, see HA
Deployment Overview.
Heartbeat Timeout (seconds)
Type the time, in seconds, you want to elapse
before the primary host is considered unavailable if
there is no heartbeat detected. The default is 30
seconds.
If the secondary host detects a failure, the
secondary host automatically assumes all
responsibilities of the primary host.
For more information on failover scenarios, see HA
Deployment Overview.
Network Connectivity Test
Type the IP address(es) of the host(s) you want the
List peer IP addresses (comma secondary host to ping, as a means to test it’s own
delimited)
network connection. The default is all other
managed hosts in your deployment.
For more information on network connectivity
testing, see Primary Network Failure.
Disk Synchronization Rate
(MB/s)
Type or select the disk synchronization rate. The
default is 100 MB/s.
Note: When you initially add an HA cluster, the first
disk synchronization can take an extended
period of time to complete, depending on size of
your /store partition and your disk
synchronization speed. For example, the initial
disk synchronization can take up to 24 hours or
more. The secondary host only assumes the
Standby status after the initial disk
synchronization is complete.
Note: We require that the connection between the
primary host and secondary host have a
minimum bandwidth of 1 gigabits per second
(Gbps).
Disable Disk Replication
Select this option if you want to disable disk
replication.
Note: This option is only visible for non-Console
hosts.
c
Click Next.
STRM Log Manager Administration Guide
40
MANAGING HIGH AVAILABILITY
The HA Wizard connects to the primary and secondary host to perform the
following validations:
•
Verifies that the secondary host has a valid HA activation key.
•
Verifies that the secondary host is not already added to another HA cluster.
•
Verifies that the software versions on the primary and secondary hosts are the
same.
•
Verifies that the primary and secondary hosts support the same Device Support
Module (DSM), scanner, and protocol RPMs.
•
Verifies if the primary host has an externally mounted storage system. If it does,
the HA wizard then verifies that the secondary host also has an externally
mounted storage system.
If any of these validations fail, the HA wizard displays an error message and then
closes.
The Confirm the High Availability Wizard Options window is displayed.
CAUTION
If the primary host is configured with external storage, you must configure the
secondary host with the same external storage before continuing.
Step 9 Review the information. Click Finish.
NOTE
NOTE
If Disk Synchronization is enabled, it can take 24 hours or more for the data to
initially synchronize.
If required, click Back to return to the Confirm the High Availability Wizard options
window to edit the information.
The System and License Management window displays the HA cluster you added.
Use the Arrow icon to display or hide the secondary host.
The System and License Management window provides the status of your HA
clusters, including:
STRM Log Manager Administration Guide
Adding an HA Cluster
Table 4-3 HA Status Descriptions
Status
Description
Active
Specifies that the host is acting as the active system
with all services running. Either the primary or
secondary host can display the Active status. If the
secondary host is displaying the Active status,
failover has occurred.
Standby
Specifies that the host is acting as the standby
system. This status will only display for a secondary
host. The standby system has no services running. If
disk replication is enabled, the standby system is
replicating data from the primary host. If the primary
host fails, the standby system automatically
assumes the active role.
Failed
Specifies that the host is in a failed state. Both the
primary or secondary host can display the Failed
status:
•
If the primary host displays the Failed status, the
secondary host takes over the services and
should now display the Active status.
•
If the secondary host displays the Failed status,
the primary host remains active, but is not
protected by HA.
A system in the failed state must be manually
repaired (or replaced), and then restored. See
Restoring a Failed Host.
Note: Depending on the type of failure that caused
the failover, you may not be able to access a
failed system from the Console.
Synchronizing
Specifies that the host is synchronizing data on the
local disk of the host to match the currently active
system.
Note: This status is only displayed if disk replication
is enabled.
Online
Specifies that the host is online.
Offline
Specifies that the host is offline. All processes are
stopped and the host is not monitoring the heartbeat
from the active system. Both the primary and the
secondary can display the Offline status. While in the
Offline state, disk replication continues if it is
enabled.
Restoring
Once you select High Availability > Restore
System to restore a failed host (see Restoring a
Failed Host), this status specifies that system is in
the process of restoring.
STRM Log Manager Administration Guide
41
42
MANAGING HIGH AVAILABILITY
Table 4-3 HA Status Descriptions (continued)
Status
Description
Needs License
Specifies that a license key is required for the HA
cluster. See Chapter 3 - Managing the System Updating your License Key. In the Needs License
state, no processes are running.
Setting Offline
Specifies that the host is in the process of changing
state from online to offline.
Setting Online
Specifies that the host is in the process of changing
state from offline to online.
Needs Upgrade
Specifies that the host requires a software upgrade,
because the primary host has been upgraded to a
newer software version.
If the secondary host displays the Needs Upgrade
status, the primary host remains active, but is not
protected by HA. Heartbeat monitoring and disk
replication, if enabled, continue to function.
Note: Only a secondary host can display a Needs
Upgrade status.
Upgrading
Specifies that the host is in the process of upgrading
software.
If the secondary host displays the Upgrading status,
the primary host remains active, but is not protected
by HA. Heartbeat monitoring and disk replication, if
enabled, continue to function.
Note: Only a secondary host can display an
Upgrading status.
Editing an HA
Cluster
Using the Edit HA Host feature, you can edit the advanced options for your HA
cluster.
To edit an HA cluster:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the System and License Management icon.
The System and License Management window is displayed.
Step 4 Select the row for the HA cluster you want to edit.
Step 5 From the High Availability menu, select Edit HA Host.
The HA Wizard is displayed.
Step 6 Edit the parameters in the advanced options section. See Table 4-2.
Step 7 Click Next.
STRM Log Manager Administration Guide
Editing an HA Cluster
The Confirm the High Availability Wizard Options window is displayed.
Step 8 Review the information. Click Finish.
The secondary host restarts and your HA cluster continues functioning.
STRM Log Manager Administration Guide
43
44
MANAGING HIGH AVAILABILITY
Removing an HA
Host
You can remove an HA host from a cluster. You cannot remove a host from an HA
cluster when the primary HA host is in the Failed, Offline, or Synchronizing state.
To remove an HA host:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the System and License Management icon.
The System and License Management window is displayed.
Step 4 Select the HA host you want to set to remove.
Step 5 From the High Availability menu, select Remove HA Host.
A confirmation message is displayed, indicating that removing an HA host reboots
the user interface.
Step 6 Click OK.
Once you remove an HA host, the host restarts and becomes available to be
added to another cluster.
Setting an HA Host
Offline
You can set either the primary or secondary host to Offline from the Active or
Standby state. If you set the active system to Offline, the standby system becomes
the active system, thereby forcing a failover. If you set the standby system to
Offline, the standby system no longer monitors the heartbeat of the active system,
however, continues to synchronize data from the active system.
To set an HA host offline:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the System and License Management icon.
The System and License Management window is displayed.
Step 4 Select the HA host you want to set to offline.
Step 5 From the High Availability menu, select Set System Offline.
The status for the host changes to Offline.
STRM Log Manager Administration Guide
Setting an HA Host Online
Setting an HA Host
Online
45
When you set the secondary host to online, the secondary host becomes the
standby system. If you set the primary host to Online while the secondary system
is currently the active system, the primary host becomes the active system and the
secondary host automatically becomes the standby system.
To set an HA host online:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the System and License Management icon.
The System and License Management window is displayed.
Step 4 Select the offline HA host you want to set to online.
Step 5 From the High Availability menu, select Set System Online.
The status for the host changes to Online.
Restoring a Failed
Host
If a host displays a status of Failed, a hardware or network failure occurred for that
host. Before you can restore the host using the user interface, you must manually
repair the host. For more information, see your network administrator.
To restore a failed system:
Step 1 Recover the failed host.
NOTE
Recovering a failed host involves re-installing STRM Log Manager. For more
information on recovering a failed host, see the STRM Log Manager Installation
Guide. If you are recovering a primary host and your HA cluster uses shared
storage, you must manually configure iSCSI. For more information on configuring
iSCSI, see the Configuring iSCSI Technical Note.
Step 2 Click the Admin tab.
Step 3 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 4 Click the System and License Management icon.
The System and License Management window is displayed.
Step 5 Select the failed HA host you want to restore.
Step 6 From the High Availability menu, select Restore System.
The system restores the HA configuration on the failed host. The status of the host
changes through the following sequence:
STRM Log Manager Administration Guide
46
MANAGING HIGH AVAILABILITY
a
Restoring
b
Synchronizing (if disk synchronization is enabled)
c
Standby (secondary host) or Offline (primary host)
If the restored host is the primary system, you must manually set the primary
system to the Online state. See Setting an HA Host Online.
STRM Log Manager Administration Guide
5
SETTING UP STRM LOG MANAGER
This chapter provides information on setting up STRM Log Manager, including:
Creating Your
Network Hierarchy
•
Creating Your Network Hierarchy
•
Scheduling Automatic Updates
•
Configuring System Settings
•
Using Event Retention Buckets
•
Configuring System Notifications
•
Configuring the Console Settings
STRM Log Manager uses the network hierarchy to understand your network and
provide you with the ability to view network information for your entire deployment.
When you develop your network hierarchy, you should consider the most effective
method for viewing network activity. The network you configure in STRM Log
Manager does not have to resemble the physical deployment of your network.
STRM Log Manager supports any network hierarchy that can be defined by a
range of IP addresses. You can create your network based on many different
variables, including geographical or business units.
Best Practices
Consider the following when defining your network hierarchy:
•
Group together systems and user groups that have similar behavior. This
provides you with a clear view of your network.
•
Do not group together servers that have unique behavior with other servers on
your network. For example, placing a unique server alone provides the server
greater visibility in STRM Log Manager, allowing you to enact specific policies.
•
Combine multiple Classless Inter-Domain Routings (CIDRs) or subnets into a
single network/group to conserve disk space. For example:
Group
Description
IP Address
1
Marketing
10.10.5.0/24
2
Sales
10.10.8.0/21
STRM Log Manager Administration Guide
48
SETTING UP STRM LOG MANAGER
Group
Description
IP Address
3
Database Cluster
10.10.1.3/32
10.10.1.4/32
10.10.1.5/32
NOTE
We recommend that you do not configure a network group with more than 15
objects. This may cause you difficulty in viewing detailed information for each
group.
You may also want to define an all-encompassing group so when you define new
networks, the appropriate policies and behavioral monitors are applied. For
example:
Defining Your
Network Hierarchy
Group
Subgroup
IP Address
Cleveland
Cleveland misc
10.10.0.0/16
Cleveland
Cleveland Sales
10.10.8.0/21
Cleveland
Cleveland Marketing
10.10.1.0/24
To define your network hierarchy:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the Network Hierarchy icon.
The Network Views window is displayed.
Step 4 From the menu tree, select the areas of the network you want to add a network
component.
The Manage Group window is displayed for the selected network component.
Step 5 Click Add.
The Add Network Object window is displayed.
Step 6 Enter your network object values:
Table 5-1 Add New Object Parameters
Parameter
Action
Group
From the drop-down list box, select a group for the new network
object and click Add Group.
Note: If required, you can create a new group. Click Add Group,
type a unique name for the group in the dialog box, and then
click OK.
STRM Log Manager Administration Guide
Creating Your Network Hierarchy
49
Table 5-1 Add New Object Parameters (continued)
Parameter
Action
Name
Type a unique name for the object.
Weight
Type or select the weight of the object. The range is 0 to 100 and
indicates the importance of the object in the system.
IP/CIDR(s)
Type the CIDR range(s) for this object and click Add. For more
information on CIDR values, see Accepted CIDR Values.
Description
Type a description for this network object.
Color
Click Select Color and select a color for this object.
Database Length
From the drop-down list box, select the database length.
Step 7 Click Save.
Step 8 Repeat for all network objects.
Step 9 Click Re-Order.
The Reorder Group window is displayed.
Step 10 Order the network objects in the desired order.
Step 11 Click Save.
NOTE
We recommend adding key servers as individual objects and grouping other major
but related servers into multi-CIDR objects.
Accepted CIDR Values
The following table provides a list of the CIDR values that STRM Log Manager
accepts:
Table 5-2 Accepted CIDR Values
CIDR
Length
Mask
Number of
Networks
Hosts
/1
128.0.0.0
128 A
2,147,483,392
/2
192.0.0.0
64 A
1,073,741,696
/3
224.0.0.0
32 A
536,870,848
/4
240.0.0.0
16 A
268,435,424
/5
248.0.0.0
8A
134,217,712
/6
252.0.0.0
4A
67,108,856
/7
254.0.0.0
2A
33,554,428
/8
255.0.0.0
1A
16,777,214
/9
255.128.0.0
128 B
8,388,352
/10
255.192.0.0
64 B
4,194,176
STRM Log Manager Administration Guide
50
SETTING UP STRM LOG MANAGER
Table 5-2 Accepted CIDR Values (continued)
CIDR
Length
Mask
Number of
Networks
Hosts
/11
255.224.0.0
32 B
2,097,088
/12
255.240.0.0
16 B
1,048,544
/13
255.248.0.0
8B
524,272
/14
255.252.0.0
4B
262,136
/15
255.254.0.0
2B
131,068
/16
255.255.0.0
1B
65,534
/17
255.255.128.0
128 C
32,512
/18
255.255.192.0
64 C
16,256
/19
255.255.224.0
32 C
8,128
/20
255.255.240.0
16 C
4,064
/21
255.255.248.0
8C
2,032
/22
255.255.252.0
4C
1,016
/23
255.255.254.0
2C
508
/24
255.255.255.0
1C
254
/25
255.255.255.128
2 subnets
124
/26
255.255.255.192
4 subnets
62
/27
255.255.255.224
8 subnets
30
/28
255.255.255.240
16 subnets
14
/29
255.255.255.248
32 subnets
6
/30
255.255.255.252
64 subnets
2
/31
255.255.255.254
none
none
/32
255.255.255.255
1/256 C
1
For example, a network is called a supernet when the prefix boundary contains
fewer bits than the network's natural (such as, classful) mask. A network is called a
subnet when the prefix boundary contains more bits than the network's natural
mask:
•
209.60.128.0 is a class C network address with a mask of /24.
•
209.60.128.0 /22 is a supernet that yields:
209.60.128.0 /24
209.60.129.0 /24
209.60.130.0 /24
209.60.131.0 /24
•
192.0.0.0 /25
Subnet Host Range
STRM Log Manager Administration Guide
Scheduling Automatic Updates
51
0 192.0.0.1-192.0.0.126
1 192.0.0.129-192.0.0.254
•
192.0.0.0 /26
Subnet Host Range
0 192.0.0.1 - 192.0.0.62
1 192.0.0.65 - 192.0.0.126
2 192.0.0.129 - 192.0.0.190
3 192.0.0.193 - 192.0.0.254
•
192.0.0.0 /27
Subnet Host Range
0 192.0.0.1 - 192.0.0.30
1 192.0.0.33 - 192.0.0.62
2 192.0.0.65 - 192.0.0.94
3 192.0.0.97 - 192.0.0.126
4 192.0.0.129 - 192.0.0.158
5 192.0.0.161 - 192.0.0.190
6 192.0.0.193 - 192.0.0.222
7 192.0.0.225 - 192.0.0.254
Scheduling
Automatic Updates
NOTE
NOTE
STRM Log Manager uses system configuration files to provide useful
characterizations of security event logs. You can update your configuration files
automatically or manually using the STRM Log Manager interface to ensure your
configuration files contain the latest network security information. The updates,
available on the Juniper customer support web site (www.juniper.net/support/),
include threats, vulnerabilities, and geographic information from various security
related web sites. The Console must be connected to the Internet to receive the
updates.
We do not guarantee the accuracy of the information contained on third-party web
sites.
In a High Availability (HA) deployment, once you update your configuration files
on the primary host and deploy your changes, the updates are automatically
STRM Log Manager Administration Guide
52
SETTING UP STRM LOG MANAGER
performed on the secondary host. If you do not deploy your changes, the updates
are performed on the secondary host hourly through an automated process.
You can configure the automatic updates to include minor updates (such as Online
Help or script updates), major updates (such as JAR file updates), or DSM
updates.Major updates and DSM updates must be downloaded and installed
manually.
STRM Log Manager allows you to either replace your existing configuration files or
integrate the updates with your existing files to maintain the integrity of your
current configuration and information.
You can also update the configuration files for all systems in your STRM Log
Manager deployment. However, the views must currently exist in your deployment
editor. For more information on using the deployment editor, see Using the
Deployment Editor.
NOTE
Failing to build your deployment map before you configure automatic or manual
updates results in your remote systems not being updated.
This section includes:
Scheduling
Automatic Updates
•
Scheduling Automatic Updates
•
Updating Your Files On-Demand
To schedule automatic updates:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the Auto Update icon.
The Auto Update Configuration window is displayed.
Step 4 In the Choose Updates panel, configure the update method and types of updates
you want to receive:
STRM Log Manager Administration Guide
Scheduling Automatic Updates
53
Table 5-3 Choose Updates Panel Parameters
Parameter
Description
Update Method
From the drop-down list box, select the method you want to use
for updating your system:
Weekly Updates
Minor Updates
Major Updates
DSM Updates
Download Path
•
Auto Integrate - Select this option to integrate the new
configuration files with your existing files and maintain the
integrity of your information. This is the default.
•
Auto Update - Select this option to replace your existing
configuration files with the new configuration files.
Weekly updates include vulnerability, QID map, and security
threat information updates. From the drop-down list box, select
one of the following:
•
Enabled - Select this option to allow weekly updates to be
installed on your system. This is the default.
•
Disabled - Select this option to prevent weekly updates being
installed on your system.
Minor updates include items such as additional Online Help
content or updated scripts. From the drop-down list box, select
one of the following options for minor updates:
•
Disabled - Select this option to prevent minor updates being
installed on your system.
•
Download - Select this option to download the minor updates
to the designated download path location. See the readme file
in the download files for installation instructions.
•
Install - Select this option to automatically install minor
updates on your system. This is the default.
Major updates require service interruptions during installation.
Major updates include such items as updated JAR files. From the
drop-down list box, select one of the following options for major
updates:
•
Disabled - Select this option to prevent major updates being
installed on your system. This is the default.
•
Download - Select this option to download the major updates
to the designated download path location. See the readme file
in the download files for installation instructions.
From the drop-down list box, select one of the following options
for DSM updates:
•
Disabled - Select this option to prevent DSM updates being
installed on your system.
•
Download - Select this option to download the DSM updates
to the designated download path location. This is the default.
See the readme file in the download files for installation
instructions.
Type the directory path location to which you want to store DSM,
minor, and major updates. The default directory path is
/store/configservices/staging/updates.
STRM Log Manager Administration Guide
54
SETTING UP STRM LOG MANAGER
Step 5 In the Server Configuration panel, configure the server settings:
Table 5-4 Server Configuration Panel Parameters
Parameter
Description
Webserver
Type the webserver from which you want to obtain the updates.
The default webserver is:
www.juniper.net/support/
Directory
Type the directory location on which you want to store the
updates. The default directory is autoupdates/.
Proxy Server
Type the URL for the proxy server.
Proxy Port
Type the port for the proxy server.
Proxy Username
Type the necessary username for the proxy server. A username
is only required if you are using an authenticated proxy.
Proxy Password
Type the necessary password for the proxy server. A password
is only required if you are using an authenticated proxy.
Step 6 In the Update Settings panel, configure the update settings:
Table 5-5 Update Settings Panel Parameters
Parameter
Description
Deploy changes
Select this check box if you want to deploy update changes
automatically. If the check box is clear, a system notification is
displayed in the Dashboard indicating that you must deploy
changes. By default, the check box is clear.
Send feedback
Select this check box if you want to send feedback to Juniper
Networks regarding the update. Feedback is sent automatically
using a web form when errors occur with the update. By default,
the check box is clear.
Backup Retention Type or select the length of time, in days, that you want to store
Period (days)
files that are replaced during the update process. The files are
stored in the location specified in the Backup Location
parameter. The default backup retention period is 30 days. The
minimum is 1 day and the maximum is 65535.
Backup Location
Type the location that you want to store backup files.
Step 7 In the Schedule Updates panel, configure the schedule for updates:
STRM Log Manager Administration Guide
Scheduling Automatic Updates
55
Table 5-6 Schedule Update Panel Parameters
Parameter
Description
Schedule Update
Frequency
From the drop-down list box, select the frequency with which you
want to receive updates. Options include:
•
Disabled
•
Weekly
•
Monthly
•
Daily
The default frequency is daily.
Hour
From the drop-down list box, select the time of day you want your
system to update. The default hour is 1 am.
Week Day
This option is only available if you select Weekly as the update
frequency.
From the drop-down list box, select the day of the week you
want to receive updates. The default week day is Monday.
Month Day
This option is only active when you select Monthly as the update
frequency.
From the drop-down list box, select the day of the month you
want to receive updates. The default month day is 1.
Step 8 Click Save.
If you selected the Deploy Changes check box, the updates are enforced through
your deployment. Once the automatic update process is complete, a system
notification is displayed in the Dashboard and information about the automatic
update is displayed in the Log field. For more information on the Dashboard, see
the STRM Log Manager Users Guide.
Updating Your Files
On-Demand
You can update your files, whenever necessary, using the Auto Update window.
To update your files:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the Auto Update icon.
The Auto Update Configuration window is displayed.
Step 4 From the Update Method drop-down list box in the Choose Updates panel, select
the method you want to use for updating your files:
•
Auto Integrate - Select this option to integrate the new configuration files with
your existing files and maintain the integrity of your information.
•
Auto Update - Select this option to replace your existing configuration files with
the new configuration files.
STRM Log Manager Administration Guide
56
SETTING UP STRM LOG MANAGER
Step 5 Click Save and Update Now.
Step 6 From the Admin interface menu, click Deploy Changes.
Once the automatic update process is complete, a system notification is displayed
in the Dashboard. For more information, see the STRM Log Manager Users Guide.
Configuring
System Settings
Using the Admin interface, you can configure the system, database, and sentry
settings.
To configure system settings:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the System Settings icon.
The System Settings window is displayed.
Step 4 Configure the following parameters:
Table 5-7 System Settings Parameters
Parameter
Description
System Settings
Administrative Email
Address
Type the email address of the designated system
administrator. The default email address is
root@localhost.
Alert Email From Address Type the email address from which you want to receive
email alerts. This address is displayed in the From field of
the email alerts. A valid address is required by most email
servers. The default email address is
root@<hostname.domain>.
Delete Root Mail
Temporary Files
Retention Period
Root mail is the default location for host context
messages. From the drop-down list box, select one of the
following options:
•
Yes - Delete the local administrator email. This is the
default.
•
No - Do not delete local administrator email.
From the drop-down list box, select the period of time you
want the system to retain temporary files. The default
storage location for temporary files is the /store/tmp
directory. The default retention period is 6 hours. The
minimum is 6 hours and the maximum is 2 years.
STRM Log Manager Administration Guide
Configuring System Settings
57
Table 5-7 System Settings Parameters (continued)
Parameter
Description
Coalescing Events
From the drop-down list box, select one of the following
options:
•
Yes - Enables log sources to coalesce (bundle) events.
•
No - Prevents log sources from coalescing (bundling)
events.
This value applies to all log sources. However, if you want
to alter this value for a specific log source, edit the
Coalescing Event parameter in the log source
configuration. For more information, see the Managing
Log Sources Guide.
The default setting is Yes.
Store Event Payload
From the drop-down list box, select one of the following
options:
•
Yes - Enables log sources to store event payload
information.
•
No - Prevents log sources from storing event payload
information.
This value applies to all log sources. However, if you want
to alter this value for a specific log source, edit the Event
Payload parameter in the log source configuration. For
more information, see the Log Sources Users Guide.
The default setting is Yes.
Global Iptables Access
Type the IP address of a non-Console system that does
not have iptables configuration to which you want to
enable direct access. To enter multiple systems, type a
comma-separated list of IP addresses.
Syslog Event Timeout
(minutes)
Type or select the amount of time, in minutes, that the
status of a syslog device is recorded as error if no events
have been received within the timeout period. The status
is displayed in the Log Sources window (for more
information, see the Log Sources Users Guide).
The default setting is 720 minutes (12 hours). The
minimum value is 0 and the maximum value is
4294967294.
Partition Tester Timeout
(seconds)
Type or select the amount of time, in seconds, for a
partition test to perform before a time-out occurs. The
default setting is 30. The minimum is 0 and the maximum
is 4294967294. The default setting is 86400.
Database Settings
User Data Files
Type the location of the user profiles. The default location
is /store/users.
STRM Log Manager Administration Guide
58
SETTING UP STRM LOG MANAGER
Table 5-7 System Settings Parameters (continued)
Parameter
Description
Accumulator Retention Minute-By-Minute
From the drop-down list box, select the period of time you
want to retain minute-by-minute data accumulations. The
default setting is 1 day. The minimum is 1 day and the
maximum is 2 years.
Every 60 seconds, the data is aggregated into a single
dataset.
Accumulator Retention Hourly
From the drop-down list box, select the period of time you
want to retain hourly data accumulations. The default
setting is 2 weeks. The minimum is 1 day and the
maximum is 2 years.
At the end of every hour, the minute-by minute datasets
are aggregated into a single hourly dataset.
Accumulator Retention Daily
From the drop-down list box, select the period of time you
want to retain daily data accumulations. The default
setting is 33 days. The minimum is 1 day and the
maximum is 2 years.
At the end of every day, the hourly datasets are
aggregated into a single daily dataset.
Ariel Database Settings
Log Source Storage
Location
Type the location that you want to store the log source
information. The default location is /store/ariel/events.
Note: This is a global setting, applied to Consoles and
managed hosts in your deployment.
Search Results Retention From the drop-down list box, select the amount of time
Period
you want to store event and flow search results. The
default setting is 1 day. The minimum is 1 day and the
maximum is 3 months.
Reporting Max Matched
Results
Type or select the maximum number of results you want a
report to return. This value applies to the search results in
the Offenses, Log Activity and Network Activity interfaces.
The default setting is 1,000,000. The minimum value is 0
and the maximum value is 4294967294.
Command Line Max
Matched Results
Type or select the maximum number of results you want
the AQL command line to return. The default setting is 0.
The minimum value is 0 and the maximum value is
4294967294.
Web Execution Time Limit Type or select the maximum amount of time, in seconds,
you want a query in the interface to process before a
time-out occurs. This value applies to the search results in
the Offenses, Log Activity and Network Activity interfaces.
The default setting is 600 seconds. The minimum value is
0 and the maximum value is 4294967294.
STRM Log Manager Administration Guide
Configuring System Settings
59
Table 5-7 System Settings Parameters (continued)
Parameter
Description
Reporting Execution Time Type or select the maximum amount of time, in seconds,
Limit
you want a reporting query to process before a time-out
occurs. The default setting is 57600 seconds. The
minimum value is 0 and the maximum value is
4294967294.
Command Line Execution Type or select the maximum amount of time, in seconds,
Time Limit
you want a query in the AQL command line to process
before a time-out occurs. The default setting is 0 seconds.
The minimum value is 0 and the maximum value is
4294967294.
Web Last Minute (Auto
refresh) Execution Time
Limit
From the drop-down list box, select the maximum amount
of time, in seconds, you want an auto refresh to process
before a time-out occurs. The default setting is 10
seconds. The maximum is 40 seconds.
Event Log Hashing
From the drop-down list box, select one of the following
options:
•
Yes - Enables STRM Log Manager to store a hash file
for every stored event log file.
•
No - Prevents STRM Log Manager from storing a
hash file for every stored event log file.
The default setting is No.
STRM Log Manager Administration Guide
60
SETTING UP STRM LOG MANAGER
Table 5-7 System Settings Parameters (continued)
Parameter
Description
Hashing Algorithm
You can use a hashing algorithm for database storage
and encryption. You can use one of the following hashing
algorithms:
•
Message-Digest Hash Algorithm - Transforms digital
signatures into shorter values called Message-Digests
(MD).
•
Secure Hash Algorithm (SHA) Hash Algorithm Standard algorithm that creates a larger (60 bit) MD.
From the drop-down list box, select the log hashing
algorithm you want to use for your deployment. The
options are:
•
MD2 - Algorithm defined by RFC 1319.
•
MD5 - Algorithm defined by RFC 1321.
•
SHA-1 - Algorithm defined by Secure Hash Standard
(SHS), NIST FIPS 180-1. This is the default.
•
SHA-256 - Algorithm defined by the draft Federal
Information Processing Standard 180-2, SHS.
SHA-256 is a 255-bit hash algorithm intended for 128
bits of security against security attacks.
•
SHA-384 - Algorithm defined by the draft Federal
Information Processing Standard 180-2, SHS.
SHA-384 is a bit hash algorithm, created by truncating
the SHA-512 output.
•
SHA-512 - Algorithm defined by the draft Federal
Information Processing Standard 180-2, SHS.
SHA-512 is a bit hash algorithm intended to provide
256 bits of security.
Transaction Sentry Settings
Transaction Max Time
Limit
A transaction sentry detects unresponsive applications
using transaction analysis. If an unresponsive application
is detected, the transaction sentry attempts to return the
application to a functional state.
From the drop-down list box, select the length of time you
want the system to check for transactional issues in the
database. The default setting is 10 minutes. The minimum
is 1 minute and the maximum is 30 minutes.
Resolve Transaction on
Non-Encrypted Host
From the drop-down list box, select whether you want the
transaction sentry to resolve all error conditions detected
on the Console or non-encrypted managed hosts.
If you select No, the conditions are detected and logged,
but you must manually intervene and correct the error.
The default setting is Yes.
STRM Log Manager Administration Guide
Configuring System Settings
61
Table 5-7 System Settings Parameters (continued)
Parameter
Description
Resolve Transaction on
Encrypted Host
From the drop-down list box, select whether you want the
transaction sentry to resolve all error conditions detected
on the encrypted managed host.
If you select No, the conditions are detected and logged
but you must manually intervene and correct the error.
The default setting is Yes.
SNMP Settings
SNMP Version
From the drop-down list box, choose one of the following
options:
•
Disabled - Select this option if you do not want SNMP
responses in the STRM Log Manager custom rules
engine. Disabling SNMP indicates that you do not want
to accept events using SNMP. This the default.
•
SNMPv3 - Select this option if you want to use SNMP
version 3 in your deployment.
•
SNMPv2c - Select this option if you want to use SNMP
version 2 in your deployment.
SNMPv2c Settings
Destination Host
Type the IP address to which you want to send SNMP
notifications.
Destination Port
Type the port to which you want to send SNMP
notifications. The default port is 162.
Community
Type the SNMP community, such as public.
SNMPv3 Settings
Destination Host
Type the IP address to which you want to send SNMP
notifications.
Destination Port
Type the port to which you want to send SNMP
notifications. The default port is 162.
Username
Type the name of the user you want to access SNMP
related properties.
Security Level
From the drop-down list box, select the security level for
SNMP. The options are:
•
NOAUTH_NOPRIV - Indicates no authorization and no
privacy. This the default.
•
AUTH_NOPRIV - Indicates authorization is permitted
but no privacy.
•
AUTH_PRIV - Allows authorization and privacy.
Authentication Protocol
From the drop-down list box, select the algorithm you
want to use to authenticate SNMP traps.
Authentication Password
Type the password you want to use to authenticate SNMP
traps.
STRM Log Manager Administration Guide
62
SETTING UP STRM LOG MANAGER
Table 5-7 System Settings Parameters (continued)
Parameter
Description
Privacy Protocol
From the drop-down list box, select the protocol you want
to use to decrypt SNMP traps.
Privacy Password
Type the password used to decrypt SNMP traps.
Embedded SNMP Agent Settings
Enabled
From the drop-down list box, select one of the following:
•
Yes - Enables access to data from the SNMP Agent
using SNMP requests.
•
No - Disables access to data from the SNMP Agent
using SNMP requests.
The default setting is Yes.
Community String
Type the SNMP community, such as public. This
parameter only applies if you are using SNMPv2 and
SNMPv3.
IP Access List
Type the systems that can access data from the SNMP
agent using an SNMP request. If the Enabled option is
set to Yes, this option is enforced.
IF-MAP Client/Server Settings
IF-MAP Version
The Interface For Metadata Access Points (IF-MAP) rule
response enables STRM Log Manager to publish alert
and offense data derived from events, flows, and offense
data on an IF-MAP server.
From the drop-down list box, select one of the following:
•
Disabled - Select this option if you want to disable
access to the IF-MAP Server. This is the default
setting. When disabled, the other IF-MAP Client/Server
settings are not displayed.
•
1.1 - Select this option if you want to use IF-MAP
version 1.1 in your deployment.
•
2.0 - Select this option if you want to use IF-MAP
version 2.0 in your deployment.
Server Address
Type the IP address of the IF-MAP server.
Basic Server Port
Type or select the port number for the basic IF-MAP
server. The default port is 8443.
Credential Server Port
Type or select the port number for the credential server.
The default port is 8444.
STRM Log Manager Administration Guide
Configuring System Settings
63
Table 5-7 System Settings Parameters (continued)
Parameter
Description
Authentication
Before you can configured IF-MAP authentication, you
must configure your IF-MAP server certificate. For more
information on how to configure your IF-MAP certificate,
see Configuring your IF-MAP Server Certificates.
Using the drop-down list box, select the authentication
type from the following options:
Key Password
•
Basic - Select this option to use basic authentication.
Once you select this option, the User Name and User
Password parameters are displayed.
•
Mutual - Select this option to use mutual
authentication. Once you select this option, the Key
Password parameter is displayed. The default
authentication type is Mutual.
This setting is displayed only when you select the Mutual
option for the Authentication setting.
Type the key password to be shared between the IF-MAP
client and server.
User Name
This setting is displayed only when you select the Basic
option for the Authentication setting.
Type the username required to access the IF-MAP
server.
User Password
This setting is displayed only when you select the Basic
option for the Authentication setting.
Type the password required to access the IF-MAP server.
Step 5 Click Save.
Step 6 From the Admin interface menu, select Advanced > Deploy Full Configuration.
Configuring your
IF-MAP Server
Certificates
Before you can configure IF-MAP authentication, you must configure your IF-MAP
server certificate. This section includes information on how to configure your
IF-MAP certificate, including:
•
Configuring IF-MAP Server Certificate for Basic Authentication
•
Configuring IF-MAP Server Certificate for Mutual Authentication
Configuring IF-MAP Server Certificate for Basic Authentication
To configure your IF-MAP certificate for basic authentication:
Step 1 Contact your IF-MAP server administrator to obtain a copy of the IF-MAP server
public certificate. The certificate must have the .cert file extension, for example,
ifmapserver.cert.
Step 2 Log in to STRM Log Manager as root and copy the certificate to the
/opt/qradar/conf/trusted_certificates directory.
STRM Log Manager Administration Guide
64
SETTING UP STRM LOG MANAGER
Configuring IF-MAP Server Certificate for Mutual Authentication
Mutual authentication requires certificate configuration on your STRM Log
Manager Console and your IF-MAP server. For assistance configuring the
certificate on your IF-MAP server, contact your IF-MAP server administrator.
To configure your IF-MAP certificate for mutual authentication:
Step 1 Contact your IF-MAP server administrator to obtain a copy of the IF-MAP server
public certificate. The certificate must have the .cert file extension, for example,
ifmapserver.cert.
Step 2 Log in to STRM Log Manager as root and the certificate to the
/opt/qradar/conf/trusted_certificates directory
Step 3 Copy the SSL certificate and SSL Verisign root certificate to your IF-MAP server as
CA certificates. For assistance, contact your IF-MAP server administrator.
Step 4 Type the following command to create the Public-Key Cryptography Standards file
with the .pkcs12 file extension using the following command:
openssl pkcs12 -export -inkey <private_key> -in <certificate>
-out <pkcs12_filename.pkcs12> -name "IFMAP Client"
Step 5 Type the following command to copy the pkcs12 file to the
$NVACONF/key_certificates directory:
cp <pkcs12_filename.pkcs12> $NVACONF/key_certificates
Step 6 Create a client on the IF-MAP server with the Certificate authentication and upload
the SSL certificate. For assistance, contact your IF-MAP server administrator.
Using Event
Retention Buckets
Using the Event Retention feature available on the Admin interface, you can
configure retention buckets. Each retention bucket defines a retention policy for
events that match custom filter requirements. As STRM Log Manager receives
events, each event is compared against retention bucket filter criteria. When an
event matches a retention bucket filter, it is stored in that retention bucket until the
retention policy time period is reached. This feature enables you to configure
multiple retention buckets.
Retention buckets are sequenced in priority order from the top row to the bottom
row in the Event Retention window. A record is stored in the bucket that matches
the filter criteria with highest priority. If the record does not match any of your
configured retention buckets, the record is stored in the default retention bucket,
which is always located below the list of configurable retention buckets.
This section provides information on managing event retention buckets, including:
•
Configuring Event Retention Buckets
•
Managing Retention Buckets
STRM Log Manager Administration Guide
Using Event Retention Buckets
Configuring Event
Retention Buckets
65
By default, the Event Retention feature provides a default retention bucket and 10
unconfigured retention buckets. Until you configure an event retention bucket, all
events are stored in the default retention bucket.
To configure an event retention bucket:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click Data Sources.
The Data Sources panel is displayed.
Step 3 Click the Event Retention icon.
The Event Retention window is displayed, providing the following information for
each retention bucket:
Table 5-8 Event Retention Window Parameters
Parameter
Description
Order
Specifies the priority order of the retention buckets.
Name
Specifies the name of the retention bucket.
Retention
Specifies the retention period of the retention bucket.
Compression
Specifies the compression policy of the retention bucket.
Deletion Policy
Specifies the deletion policy of the retention bucket.
Filters
Specifies the filters applied to the retention bucket. Move your
mouse pointer over the Filters parameter for more information
about the applied filters.
Records
Specifies how many events are stored in the retention bucket.
Enabled
Specifies whether the retention bucket is enabled (true) or
disabled (false). The default setting is true.
Creation Date
Specifies the date and time the retention bucket was created.
Modification Date
Specifies the date and time the retention bucket was last
modified.
The Event Retention toolbar provides the following functions:
Table 5-9 Event Retention Window Toolbar
Icon
Function
Edit
Click Edit to edit a retention bucket. For more information on
editing a retention bucket, see Editing a Retention Bucket.
Enable/Disable
Click Enable/Disable to enable or disable a retention bucket.
For more information on enabling and disabling retention
buckets, see Enabling and Disabling a Retention Bucket.
Delete
Click Delete to delete a retention bucket. For more
information about deleting retention buckets, see Deleting a
Retention Bucket.
Step 4 Double-click the first available retention bucket.
STRM Log Manager Administration Guide
66
SETTING UP STRM LOG MANAGER
The Retention Properties window is displayed.
Step 5 Configure the following parameters:
Table 5-10
Retention Properties Window Parameters
Parameter
Description
Name
Type a unique name for the retention bucket.
Keep data placed
in this bucket for
From the drop-down list box, select a retention period. When the
retention period is reached, events are deleted according to the
Delete data in this bucket parameter. The default setting is 1
week. The minimum is 1 day and the maximum is 2 years.
Allow data is this
bucket to be
compressed
Select the check box to enable data compression, and then
select a time frame from the drop-down list box. When the time
frame is reached, all events in the retention bucket are
compressed. The default setting is 2 weeks. The minimum is
Never and the maximum is 2 weeks.
Delete data in this From the drop-down list box, select a deletion policy. Options
bucket
include:
•
When storage space is required - Select this option if you
want events that match the Keep data placed in this bucket
for parameter to remain in storage until the disk monitoring
system detects that storage is required. When storage is
required, only events that match the Keep data placed in this
bucket for parameter are deleted.
•
Immediately after the retention period has expired - Select
this option if you want events to be deleted immediately on
matching the Keep data placed in this bucket for parameter.
The events are deleted at the next scheduled disk
maintenance process, which occurs hourly.
Description
Type a description for the retention bucket. This field is optional.
Current Filters
In the Current Filters section, configure your filter(s).
To add a filter:
1 From the first drop-down list box, select an parameter you
want to filter for. For example, Device, Source Port, or Event
Name.
2 From the second drop-down list box, select the modifier you
want to use for the filter. The list of modifiers depends on the
attribute selected in the first list.
3 In the text field, type specific information related to your filter.
4 Click Add Filter.
The filter(s) are displayed in the Current Filters text box. You
can select a filter and click Remove Filter to remove a filter from
the Current Filter text box.
Step 6 Click Save.
The Retention Properties window closes and the Event Retention window is
displayed. Your event retention bucket configuration is saved.
STRM Log Manager Administration Guide
Using Event Retention Buckets
67
Step 7 Click Save.
Your event retention bucket starts storing events that match the retention
parameters immediately.
Managing Retention
Buckets
After you configure your retention buckets, you can manage the buckets using the
Event Retention window.
This section provides information on managing retention buckets, including:
•
Managing Retention Bucket Sequence
•
Editing a Retention Bucket
•
Enabling and Disabling a Retention Bucket
•
Deleting a Retention Bucket
Managing Retention Bucket Sequence
Retention buckets are sequenced in priority order. A record is stored in the first
retention bucket that matches the record’s parameters. You can change the order
of the retention buckets to ensure that events are being matched against the
retention buckets in the order that matches your requirements.
To manage the retention bucket sequence:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click Data Sources.
The Data Sources panel is displayed.
Step 3 Click the Event Retention icon.
The Event Retention window is displayed.
Step 4 Select the retention bucket you want to move, and then click one of the following
buttons:
NOTE
•
Up - Click this button to move the selected retention bucket up one row in
priority sequence.
•
Down - Click this button to move the selected retention bucket down one row in
priority sequence.
•
Top - Click this button to move the selected retention bucket to the top of the
priority sequence.
•
Bottom - Click this button to move the selected retention bucket to the bottom
of the priority sequence.
You cannot move the default retention bucket. It always resides at the bottom of
the list.
STRM Log Manager Administration Guide
68
SETTING UP STRM LOG MANAGER
Editing a Retention Bucket
To edit a retention bucket:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click Data Sources.
The Data Sources panel is displayed.
Step 3 Click the Event Retention icon.
The Event Retention window is displayed.
Step 4 Select the retention bucket you want to edit, and then click Edit.
The Retention Properties window is displayed.
Step 5 Edit the parameters. For more information about event retention parameters, see
Table 5-10.
NOTE
In the Retention Parameters window, the Current Filters section does not display
when editing a default retention bucket.
Step 6 Click Save.
Your changes are saved.
Enabling and Disabling a Retention Bucket
Once you configure and save a retention bucket, it is enabled by default. You can
tune your event retention by disabling a bucket.
Once you disable a bucket, any new events or flows that would have matched the
requirements for the disabled bucket are stored in the next bucket that matches
the event or flow properties.
To enable or disable a retention bucket:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click Data Sources.
The Data Sources panel is displayed.
Step 3 Click the Event Retention icon.
The Event Retention window is displayed.
Step 4 Select the retention bucket you want to disable, and then click Enable/Disable.
The retention bucket is disabled. You can click Enable/Disable to enable the
retention bucket again.
STRM Log Manager Administration Guide
Configuring System Notifications
69
Deleting a Retention Bucket
Once you delete a retention bucket, the events or flows contained in the retention
bucket are not removed from the system, only the criteria defining the bucket is
deleted. All events or flows are maintained in storage.
To delete a retention bucket:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click Data Sources.
The Data Sources panel is displayed.
Step 3 Click the Event Retention icon.
The Event Retention window is displayed.
Step 4 Select the retention bucket you want to delete, and then click Delete.
The retention bucket is deleted
Configuring
System
Notifications
You can configure global system performance alerts for thresholds using the
Admin interface. This section provides information on configuring your global
system thresholds.
To configure global system thresholds:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the Global System Notifications icon.
The Global System Notifications window is displayed.
Step 4 Enter values for the parameters. For each parameter, you must select the following
options:
•
Enabled - Select the check box to enable the option.
•
Respond if value is - From the drop-down list box, select one of the following
options:
•
-
Greater Than - An alert occurs if the parameter value exceeds the
configured value.
-
Less Than - An alert occurs if the parameter value is less than the
configured value.
Resolution Message - Type a description of the preferred resolution to the
alert.
Table 5-11 Global System Notifications Parameters
Parameter
Description
User CPU usage
Type the threshold percentage of user CPU usage.
STRM Log Manager Administration Guide
70
SETTING UP STRM LOG MANAGER
Table 5-11 Global System Notifications Parameters (continued)
Parameter
Description
Nice CPU usage
Type the threshold percentage of user CPU usage at the
nice priority.
During periods of high CPU usage, processes that are
configured with the nice priority pause to enable other
processes to continue uninterrupted.
System CPU usage
Type the threshold percentage of CPU usage while
operating at the system level.
Idle CPU usage
Type the threshold percentage of idle CPU time.
Percent idle time
Type the threshold percentage of idle time.
Run queue length
Type the threshold number of processes waiting for run
time.
Number of processes in
the process list
Type the threshold number of processes in the process
list.
System load over 1
minute
Type the threshold system load average over the last
minute.
System load over 5
minutes
Type the threshold system load average over the last 5
minutes.
System load over 15
minutes
Type the threshold system load average over the last 15
minutes.
Kilobytes of memory free
Type the threshold amount, in kilobytes, of free memory.
Kilobytes of memory used Type the threshold amount, in kilobytes, of used
memory. This does not consider memory used by the
kernel.
Percentage of memory
used
Type the threshold percentage of used memory.
Kilobytes of cached swap Type the threshold amount of memory, in kilobytes,
memory
shared by the system.
Kilobytes of buffered
memory
Type the threshold amount of memory, in kilobytes, used
as a buffer by the kernel.
Kilobytes of memory used Type the threshold amount of memory, in kilobytes, used
for disc cache
to cache data by the kernel.
Kilobytes of swap memory Type the threshold amount of free memory, in kilobytes.
free
Kilobytes of swap memory Type the threshold amount of free swap memory, in
used
kilobytes.
Percentage of swap used Type the threshold percentage of used swap space.
Number of interrupts per
second
Type the threshold number of received interrupts per
second.
Received packets per
second
Type the threshold number of packets received per
second.
Transmitted packets per
second
Type the threshold number of packets transmitted per
second.
STRM Log Manager Administration Guide
Configuring the Console Settings
71
Table 5-11 Global System Notifications Parameters (continued)
Parameter
Description
Received bytes per
second
Type the threshold number of bytes received per second.
Transmitted bytes per
second
Type the threshold number of bytes transmitted per
second.
Received compressed
packets
Type the threshold number of compressed packets
received per second.
Transmitted compressed
packets
Type the threshold number of compressed packets
transmitted per second.
Received multicast
packets
Type the threshold number of received Multicast packets
per second.
Receive errors
Type the threshold number of corrupt packets received
per second.
Transmit errors
Type the threshold number of corrupt packets
transmitted per second.
Packet collisions
Type the threshold number of collisions that occur per
second while transmitting packets.
Dropped receive packets
Type the threshold number of received packets that are
dropped per second due to a lack of space in the buffers.
Dropped Transmit
packets
Type the threshold number of transmitted packets that
are dropped per second due to a lack of space in the
buffers.
Transmit carrier errors
Type the threshold number of carrier errors that occur
per second while transmitting packets.
Receive frame errors
Type the threshold number of frame alignment errors that
occur per second on received packets.
Receive fifo overruns
Type the threshold number of First In First Out (FIFO)
overrun errors that occur per second on received
packets.
Transmit fifo overruns
Type the threshold number of First In First Out (FIFO)
overrun errors that occur per second on transmitted
packets.
Transactions per second
Type the threshold number of transfers per second sent
to the system.
Sectors written per
second
Type the threshold number of sectors transferred to or
from the system
Step 5 Click Save.
Step 6 From the Admin interface menu, click Deploy Changes.
Configuring the
Console Settings
The STRM Log Manager Console provides the interface for STRM Log Manager.
The Console provides real-time views, reports, and in-depth investigation of event.
STRM Log Manager Administration Guide
72
SETTING UP STRM LOG MANAGER
You can also configure the Console to manage distributed STRM Log Manager
deployments.
You can access the Console from a standard web browser. When you access the
system, a prompt is displayed asking for a username and password, which must
be configured in advance by the STRM Log Manager administrator. STRM Log
Manager supports the following web browsers:
•
Internet Explorer 8.0 and 9.0, with Compatibility View enabled - For
instructions on how to enable Compatibility View, see your browser
documentation.
•
Mozilla Firefox - Juniper Networks is committed to supporting the Mozilla
Firefox web browser. Due to Mozilla's short release cycles, it is no longer
feasible to perform exhaustive compatibility testing on each Mozilla Firefox
release. Juniper Networks has adopted a best effort strategy to support the
Mozilla Firefox browser, in which compatibility issues are aggressively tracked
and corrected as they are reported.
To configure STRM Log Manager Console settings:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the Console icon.
The STRM Log Manager Console Settings window is displayed.
Step 4 Enter values for the parameters:
Table 5-12 STRM Log Manager Console Management Parameters
Parameter
Description
Console Settings
Enable 3D graphs in the
user interface
Results Per Page
From the drop-down list box, select one of the following:
•
Yes - Displays Dashboard graphics in 3-dimensional
format.
•
No - Displays Dashboard graphics in 2-dimensional
format.
Type the maximum number of results you want to display
in the main STRM Log Manager interface. This
parameter applies to the Events and Reports interfaces.
For example, if the Default Page Size parameter is
configured to 50, the Log Activity interface displays a
maximum of 50 events.
The default setting is 40. The minimum is 0 and the
maximum is 4294967294.
Authentication Settings
STRM Log Manager Administration Guide
Configuring the Console Settings
73
Table 5-12 STRM Log Manager Console Management Parameters (continued)
Parameter
Description
Persistent Session
Timeout (in days)
Type the length of time, in days, that a user system will be
persisted. The default setting is 0, which disables this
feature. The minimum is 0 and the maximum is
4294967294.
Maximum Login Failures
Type the number of times a login attempt may fail. The
default setting is 5. The minimum is 0 and the maximum is
4294967294.
Login Failure Attempt
Window (in minutes)
Type the length of time during which a maximum number
of login failures may occur before the system is locked.
The default setting is 10 minutes. The minimum is 0 and
the maximum is 4294967294.
Login Failure Block Time
(in minutes)
Type the length of time that the system is locked if the
maximum login failures value is exceeded. The default
setting is 30 minutes. The minimum is 0 and the
maximum is 4294967294.
Login Host Whitelist
Type a list of hosts who are exempt from being locked out
of the system. Enter multiple entries using a
comma-separated list.
Inactivity Timeout (in
minutes)
Type the amount of time that a user will be automatically
logged out of the system if no activity occurs. The default
setting is 0. The minimum is 0 and the maximum is
4294967294.
Login Message File
Type the location and name of a file that includes content
you want to display on the STRM Log Manager login
window. This file may be in text or HTML format and the
contents of the file are displayed below the current log in
window.
Event Permission
Precedence
From the drop-down list box, select the level of network
permissions you want to assign to users. This parameter
affects the events that are displayed in the Log Activity
interface. The options include:
•
Network Only - A user must have access to either the
source network or the destination network of the event
to have that event display in the Log Activity interface.
•
Devices Only - A user must have access to either the
device or device group that created the event to have
that event display in the Log Activity interface.
•
Networks and Devices - A user must have access to
both the source or the destination network and the
device or device group to have an event display in the
Log Activity interface.
•
None - All events are displayed in the Log Activity
interface. Any user with Log Activity role permissions is
able to view all events.
For more information on managing users, see Managing
User Roles and Accounts.
STRM Log Manager Administration Guide
74
SETTING UP STRM LOG MANAGER
Table 5-12 STRM Log Manager Console Management Parameters (continued)
Parameter
Description
DNS Settings
Enable DNS Lookups for
Host Identity
From the drop-down list box, select whether you want to
enable or disable the ability for STRM Log Manager to
search for host identity information. When enabled, this
information is available in the right-click menu for any IP
address or asset name in the interface. The default
setting is True.
Reporting Settings
Report Retention Period
Type the period of time, in days, that you want the system
to maintain reports. The default setting is 30 days. The
minimum is 0 and the maximum is 4294967294.
Data Export Settings
Include Header in CSV
Exports
From the drop-down list box, select whether you want to
include a header in a CSV export file.
Maximum Simultaneous
Exports
Type the maximum number of exports you want to occur
at one time. The default setting is 1. The minimum is 0
and the maximum is 4294967294.
Step 5 Click Save.
Step 6 From the Admin interface menu, click Deploy Changes.
STRM Log Manager Administration Guide
Configuring the Console Settings
STRM Log Manager Administration Guide
75
6
MANAGING BACKUP AND
RECOVERY
You can backup and recover configuration information and data for STRM Log
Manager.
NOTE
The restore process only restores your configuration information. For assistance
in restoring your data, see the Restoring Your Data Technical Note.
This chapter provides information on managing backup and recovery, including:
Managing Backup
Archives
Viewing Backup
Archives
•
Managing Backup Archives
•
Backing Up Your Information
•
Restoring Your Configuration Information
Using the Admin interface, you can:
•
View your successful backup archives. See Viewing Backup Archives.
•
Import an archive file. See Importing an Archive.
•
Delete an archive file. See Deleting a Backup Archive.
To view all successful backups:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the Backup and Recovery icon.
The Backup Archives window is displayed, providing the following information,
depending on the status of the backup processes:
•
If there are no backup archives, a message is displayed to indicate no backup
archives have been created.
STRM Log Manager Administration Guide
78
MANAGING BACKUP AND RECOVERY
•
If a backup is in progress, a status window is displayed to indicate the duration
of the current backup, which user/process initiated the backup, and provides
you with the option to cancel the backup.
•
If there are existing backup archives, the list of the successful backup archives
that exists in the database is displayed. If a backup file is deleted, it is removed
from the disk and from the database. Also, the entry is removed from this list
and an audit event is generated to indicate the removal. Each archive file
includes the data from the previous day. The list of archive is sorted by the Time
Initiated column in descending order.
The Backup Archives window provides the following information for each backup
archive.
Table 6-1 Backup Archive Window Parameters
Importing an Archive
Parameter
Description
Host
Specifies the host that initiated the backup process.
Name
Specifies the name of the backup archive. To view the backup
file, click the name of the backup. You can only download a
backup created on a Console.
Type
Specifies the type of backup. The options are:
•
config - Configuration data
•
data - Event information
Size
Specifies the size of the archive file.
Time Initiated
Specifies the time that the backup file was initiated.
Duration
Specifies the time to complete the backup process.
Initialized By
Specifies whether the backup file was created by a user or
through a scheduled process.
To import a STRM Log Manager backup archive file:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the Backup and Recovery icon.
The Backup Archives window is displayed.
Step 4 In the Upload Archive field, click Browse.
The File Upload window is displayed.
Step 5 Select the archive file you want to upload. The archive file must include a .tgz
extension. Click Open.
Step 6 Click Upload.
STRM Log Manager Administration Guide
Backing Up Your Information
Deleting a Backup
Archive
79
To delete a backup archive:
NOTE
To delete a backup archive file, the backup archive file and the Host Context
component must reside on the same system. The system must also be in
communication with the Console and no other backup can be in progress.
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the Backup and Recovery icon.
The Backup Archives window is displayed.
Step 4 Select the archive you want to delete.
Step 5 Click Delete.
Step 6 A confirmation window is displayed.
Step 7 Click OK.
Backing Up Your
Information
You can backup your configuration information and data using the Backup
Recovery Configuration window. By default, STRM Log Manager creates a backup
archive of your configuration information every night at midnight and the backup
includes configuration and/or data from the previous day.
You can backup your information using one of the following methods:
•
Creating a configuration only backup. See Initiating a Backup.
•
Scheduling a nightly backup. See Scheduling Your Backup.
•
Copying a backup archive file to the system on which you want to restore the
archive. You can then restore the data. See Restoring Your Configuration
Information.
This section provides information on both methods of backing up your data,
including:
Scheduling Your
Backup
•
Scheduling Your Backup
•
Initiating a Backup
To schedule your backup process:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
STRM Log Manager Administration Guide
80
MANAGING BACKUP AND RECOVERY
Step 3 Click the Backup and Recovery icon.
The Backup Archives window is displayed.
Step 4 Click Configure.
The Backup Recovery Configuration window is displayed.
Step 5 Enter values for the parameters:
Table 6-2 Backup Recovery Configuration Parameters
Parameter
Description
General Backup Configuration
Backup
Repository Path
Type the location you want to store your backup file. This path
must exist before the backup process is initiated. If this path does
not exist, the backup process aborts. The default is
/store/backup.
Note: If you modify this path, make sure the new path is valid on
every system in your deployment.
Note: Active data is stored on the /store directory. If you have
both active data and backup archives stored in the same
directory, data storage capacity may easily be reached and
your scheduled backups may fail. We recommend you
specify a storage location on another system, or copy your
backup archives to another system after the backup process
is complete. You can use a Network File System (NFS)
storage solution in your STRM Log Manager deployment. For
more information about using NFS, see the Using the NFS
for STRM Backups Technical Note.
Backup Retention Type or select the length of time, in days, that you want to store
Period
backup files. The default is 2 days.
Note: This period of time only affects backup files generated as a
result of a scheduled process. Manually initiated or imported
backup files are not affected by this value.
STRM Log Manager Administration Guide
Backing Up Your Information
81
Table 6-2 Backup Recovery Configuration Parameters (continued)
Parameter
Description
Nightly Backup
Schedule
Select one of the following options:
•
No Nightly Backups - Disables the creation of a backup
archive on a daily basis.
•
Configuration Backup Only - Enables the creation of a daily
backup at midnight that includes configuration information
only.
•
Configuration and Data Backups - Enables the creation of a
daily backup at midnight that includes configuration
information and data. If you select the Configuration and
Data Backups option, you can select the hosts you want to
backup.
Configuration backups includes the following components:
•
Custom rules
•
Event searches
•
Log sources
•
Groups
•
Event categories
•
Device Support Modules (DSMs)
•
User and user roles information
•
License key information
•
Custom logos
Data backups run daily to capture all data for that day on each
host, including the following information:
•
Event data
•
Report data
•
Audit log information
Configuration Only Backup
Backup Time Limit Type or select the length of time, in minutes, that you want to
allow the backup to process. The default is 180 minutes. If the
backup process exceeds the configured time limit, the backup
will automatically be canceled.
Backup Priority
From the drop-down list box, select the level of importance that
you want the system to place on the configuration information
backup process compared to other processes. Options include:
•
LOW
•
MEDIUM
•
HIGH
A priority of medium or high will have a greater impact on system
performance.
Data Backup
STRM Log Manager Administration Guide
82
MANAGING BACKUP AND RECOVERY
Table 6-2 Backup Recovery Configuration Parameters (continued)
Parameter
Description
Backup Time Limit Type or select the length of time, in minutes, that you want to
(min)
allow the backup to process. The default is 1020 minutes. If the
backup process exceeds the configured time limit, the backup
will automatically be canceled.
Backup Priority
From the drop-down list box, select the level of importance you
want the system to place on the data backup process compared
to other processes. Options include:
•
LOW
•
MEDIUM
•
HIGH
A priority of medium or high will have a greater impact on system
performance.
Step 6 Click Save.
Step 7 From the Admin interface menu, click Deploy Changes.
Initiating a Backup
To manually initiate a backup of your configuration information:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the Backup and Recovery icon.
The Backup Archives window is displayed.
Step 4 Click On Demand Backup.
The Create a Backup window is displayed.
Step 5 Enter values for the following parameters:
•
Name - Type a unique name you want to assign to this backup file. The name
must be a maximum of 100 alphanumeric characters. Also, the name may
contain following characters: underscore (_), dash (-), or period (.).
•
Description - Type a description for this backup. The name can be up to 255
characters in length.
Step 6 Click Run Backup.
A confirmation window is displayed.
Step 7 Click OK.
STRM Log Manager Administration Guide
Restoring Your Configuration Information
Restoring Your
Configuration
Information
83
You can restore configuration information from existing backup archives using the
Restore a Backup window. You can only restore a backup archive created within
the same release of software. For example, if you are running STRM Log Manager
2010.0, the backup archive must of been created in STRM Log Manager 2010.0.
You can restore configuration information in the following scenarios:
NOTE
Restoring on a
System with the
Same IP Address
•
Restore backup archive on a system that has the same IP address as the
backup archive. See Restoring on a System with the Same IP Address.
•
Restore backup archive on system with a different IP address than the backup
archive. See Restoring to a System with a Different IP Address.
If the backup archive originated on a NATed Console system, you can only restore
that backup archive on a NATed system.
To restore your configuration information on a system that has the same IP
address as the backup archive:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the Backup and Recovery icon.
The Backup Archives window is displayed.
Step 4 Select the archive you want to restore.
Step 5 Click Restore.
The Restore a Backup window is displayed.
Step 6 To restore specific items in the archive:
a
Clear the All Items check box.
The list of archived items is displayed.
b
Select the check box for each item you want to restore.
Step 7 Click Restore.
A confirmation window is displayed. Each backup archive includes IP address
information of the system from which the backup archive was created.
Step 8 Click OK.
The restore process begins. This process may take an extended period of time.
When complete, a message is displayed.
Step 9 Click OK.
STRM Log Manager Administration Guide
84
MANAGING BACKUP AND RECOVERY
Step 10 Choose one of the following options:
a
If the STRM Log Manager interface was closed during the restore process,
open a browser and log in to STRM Log Manager.
b
If the STRM Log Manager interface has not been closed, the login window is
displayed. Log in to STRM Log Manager.
A window is displayed, providing the status of the restore process. This window
provides any errors for each host. This window also provides instructions for
resolving errors that have occurred.
Step 11 Follow the instructions on the status window.
NOTE
NOTE
Restoring to a
System with a
Different IP Address
The restore process only restores your configuration information. For assistance
in restoring your data, see the Restoring Your Data Technical Note.
If the backup archive originated on an HA cluster, you must click Deploy
Changes to restore the HA cluster configuration after the restore is complete. If
disk replication is enabled, the secondary host immediately synchronizes data
once the system is restored. If the secondary host was removed from the
deployment after backup was performed, the secondary host displays a Failed
status in the System and License Management window.
To restore your configuration information on a system with a different IP address
than the backup archive:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the Backup and Recovery icon.
The Backup Archives window is displayed.
Step 4 Select the archive you want to restore.
Step 5 Click Restore.
The Restore a Backup window is displayed. Because the IP address of the system
on which you want to restore the information does not match the IP address of the
backup archive, a message is displayed to indicate that you must stop iptables on
each managed host in your deployment
Step 6 To restore specific items in the archive:
a
Clear the All Items check box.
STRM Log Manager Administration Guide
Restoring Your Configuration Information
85
The list of archived items is displayed.
b
Select the check box for each item you want to restore.
Step 7 Stop IP tables:
a
Log into the managed host, as root.
b
Type the following command:
service iptables stop
c
Repeat for all managed hosts in your deployment.
Step 8 In the Restore a Backup window, click Test Host Access.
The Restore a Backup (Managed Hosts Accessibility) window is displayed.
Table 6-3 provides the following information:
Table 6-3 Restore a Backup (Managed Host Accessibility Parameters
Parameter
Description
Host Name
Specifies the managed host name.
IP Address
Specifies the IP address of the managed host.
Access Status
Specifies the access status to the managed host. The options
include:
•
Testing Access - Specifies the test to determine access
status is not complete.
•
No Access - Specifies the managed host can not be
accessed.
•
OK - Specifies the managed host is accessible.
Step 9 When the accessibility of all hosts is determined and the status in the Access
Status column indicates OK or No Access, click Restore.
The restore process begins.
NOTE
If the Access Status column indicates No Access for a host, stop iptables (see
Step 7) again and click Test Host Access to attempt a connection.
Step 10 Click OK.
The restore process begins. This process may take an extended period of time.
Step 11 Click OK.
Step 12 Choose one of the following options:
a
If the STRM Log Manager interface was closed during the restore process,
open a browser and log in to STRM Log Manager.
b
If the STRM Log Manager interface has not been closed, the login window is
displayed. Log in to STRM Log Manager.
STRM Log Manager Administration Guide
86
MANAGING BACKUP AND RECOVERY
A window is displayed, providing the status of the restore process. This window
provides any errors for each host. This window also provides instructions for
resolving errors that have occurred.
Step 13 Follow the instructions on the status window.
NOTE
NOTE
The restore process only restores your configuration information. For assistance
in restoring your data, see the Restoring Your Data Technical Note.
If the backup archive originated on an HA cluster, you must click Deploy
Changes to restore the HA cluster configuration after the restore is complete. If
disk replication is enabled, the secondary host immediately synchronizes data
once the system is restored. If the secondary host was removed from the
deployment after backup was performed, the secondary host displays a Failed
status in the System and License Management window.
STRM Log Manager Administration Guide
7
USING THE DEPLOYMENT EDITOR
Using the deployment editor, you can manage the individual components of your
STRM Log Manager SIEM deployment. Once you configure your deployment, you
can access and configure the individual components of each managed host in your
deployment.
NOTE
The Deployment Editor requires Java Runtime Environment (JRE). You can
download Java 1.6.0_u24 at the following web site: http://www.java.com. Also, If
you are using the Firefox browser, you must configure your browser to accept
Java Network Language Protocol (JNLP) files.
CAUTION
Many third-party web browsers that use the Internet Explorer engine, such as
Maxthon or MyIE, install components that may be incompatible with the Admin
interface. You may be required to disable any third-party web browsers installed
on your system. For further assistance, please contact Customer Support.
To access the deployment editor from behind a proxy server or firewall, you must
configure the appropriate proxy settings on your desktop. This allows the software
to automatically detect the proxy settings from your browser.
To configure the proxy settings:
Open the Java configuration located in your Control Panel and configure the
IP address of your proxy server.
For more information on configuring proxy settings, see your Microsoft
documentation.
This chapter provides information on managing your views, including:
•
About the Deployment Editor
•
Building Your Event View
•
Managing Your System View
STRM Log Manager Administration Guide
88
USING THE DEPLOYMENT EDITOR
•
About the
Deployment Editor
Configuring STRM Log Manager Components
You can access the deployment editor using the Admin interface. You can use the
deployment editor to create your deployment, assign connections, and configure
each component.
The deployment editor provides the following views of your deployment:
•
•
System View - Use the System View interface to assign software components,
such as an Event Collector, to managed hosts in your deployment. The System
View interface includes all managed hosts in your deployment. A managed host
is a system in your deployment that has STRM Log Manager software installed.
By default, the System View interface also includes the following components:
-
Host Context - Monitors all STRM Log Manager components to ensure that
each component is operating as expected.
-
Accumulator - Analyzes events, reporting, writing database data, and
alerting a DSM. An accumulator resides on any host that contains an Event
Processor.
Event View - Use the Event View interface to create a view of your components
including Event Processors, Event Collectors, Off-site Sources, Off-site Targets,
and Magistrate components.
In the Event View interface, the left panel provides a list of components you can
add to the view, and the right panel provides a view of your deployment.
In the System View interface, the left panel provides a list of managed hosts, which
you can view and configure. The deployment editor polls your deployment for
updates to managed hosts. If the deployment editor detects a change to a
managed host in your deployment, a message appears notifying you of the
change. For example, if you remove a managed host, a message is displayed,
indicating that the assigned components to that host must be re-assigned to
another host. Also, if you add a managed host to your deployment, the deployment
editor displays a message indicating that the managed host has been added.
Accessing the
Deployment Editor
In the Admin interface, click Deployment Editor. The deployment editor is
displayed. Once you update your configuration settings using the deployment
editor, you must save those changes to the staging area. You must manually
deploy all changes using the Admin interface menu option. All deployed changes
are then enforced throughout your deployment.
Using the Editor
The deployment editor provides you with several menu and toolbar options when
configuring your views including:
•
Menu Options
•
Toolbar Options
STRM Log Manager Administration Guide
About the Deployment Editor
89
Menu Options
The displayed menu options depend on the selected component in your view.
Table 7-1 provides a list of the menu options.
Table 7-1 Deployment Editor Menu Options
Menu Option
Sub Menu Option
Description
File
Save to staging
Saves deployment to the staging area.
Save and close
Save deployment to the staging area and
closes the deployment editor.
Open staged
deployment
Opens a deployment that was previously
saved to the staging area.
Open production
deployment
Opens a deployment that was previously
saved.
Close current
deployment
Closes the current deployment.
Revert
Reverts current deployment to the
previously saved deployment.
Edit Preferences
Opens the preferences window.
Close editor
Closes the deployment editor.
Edit
Delete
Deletes a component, host, or connection.
Actions
Add a managed host Opens the Add a Managed Host wizard.
Manage NATed
Networks
Opens the Manage NATed Networks
window, which allows you to manage the list
of NATed networks in your deployment.
Rename component Renames an existing component.
This option is only available when a
component is selected.
Configure
Configure a STRM Log Manager
components.
This option is only available when Event
Collector or Event Processor is selected.
Assign
Assigns a component to a managed host.
This option is only available when Event
Collector or Event Processor is selected.
Toolbar Options
The toolbar options include:
Table 7-2 Toolbar Options
Button
Description
Saves deployment to the staging area and closes the deployment editor.
STRM Log Manager Administration Guide
90
USING THE DEPLOYMENT EDITOR
Table 7-2 Toolbar Options (continued)
Button
Description
Opens current production deployment.
Opens a deployment that was previously saved to the staging area.
Discards recent changes and reloads last saved model.
Deletes selected item from the deployment view.
This option is only available when the selected component has a managed
host running a compatible version of STRM Log Manager software.
Opens the Add a Managed Host wizard, which allows you to add a
managed host to your deployment.
Opens the Manage NATed Networks window, which allows you to manage
the list of NATed networks in your deployment.
Resets the zoom to the default.
Zooms in.
Zooms out.
Creating Your
Deployment
To create your deployment, you must:
1 Build your System View. See Managing Your System View.
2 Configure added components. See Configuring STRM Log Manager
Components.
3 Build your Event View. See Building Your Event View.
4 Stage the deployment. From the deployment editor menu, select File > Save to
Staging.
5 Deploy all configuration changes. From the Admin interface menu, select
Advanced > Deploy Full Configuration.
For more information on the Admin interface, see Chapter 1 - Overview.
STRM Log Manager Administration Guide
Building Your Event View
Before you Begin
Before you begin, you must:
•
Install all necessary hardware and STRM Log Manager software.
•
Install the Java Runtime Environment (JRE). You can download Java 1.6.0_u24
at the following web site: http://www.java.com.
•
If you are using the Firefox browser, you must configure your browser to accept
Java Network Language Protocol (JNLP) files.
•
Plan your STRM Log Manager deployment including the IP addresses and
login information for all devices in your STRM Log Manager deployment.
NOTE
Configuring
Deployment Editor
Preferences
91
If you require assistance with the above, please contact Juniper Networks
Customer Support.
To view the deployment editor preferences:
Step 1 Select File > Edit Preferences.
The Deployment Editor Settings window is displayed.
Step 2 Configure the parameters:
Building Your
Event View
•
Presence Poll Frequency - Type how often, in milliseconds, you want the
managed host to monitor your deployment for updates, for example, a new or
updated managed host.
•
Zoom Increment - Type the increment value when the zoom option is selected.
For example. 0.1 indicates 10%.
The Event View interface allows you to create and manage the components for
your deployment, including the following components:
•
Event Collector - Collects security events from various types of security
devices, known as log sources, in your network. The Event Collector gathers
events from local and remote log sources. The Event Collector then normalizes
the events and sends the information to the Event Processor. The Event
Collector also bundles all virtually identical events to conserve system usage.
•
Event Processor - An Event Processor processes events collected from one or
more Event Collector(s). The events are bundled once again to conserve
network usage. Once received, the Event Processor correlates the information
from STRM Log Manager and distributes to the appropriate area, depending on
the type of event. The Event Processor also includes information gathered by
STRM Log Manager to indicate any behavioral changes or policy violations for
that event. Rules are then applied to the events that allow the Event Processor
to process according to the configured rules.
STRM Log Manager Administration Guide
92
USING THE DEPLOYMENT EDITOR
To build your Event View:
1 Add SIEM components to your view. See Adding Components.
2 Connect the components. See Connecting Components.
3 Forward normalized events. See Forwarding Normalized Events.
4 Rename the components so each component has a unique name. See Renaming
Components.
Adding Components
To add components to your Event View:
Step 1 In the deployment editor, click the Event View tab.
The Event View interface is displayed.
Step 2 In the Event Tools panel, select a component you want to add to your deployment.
The Adding a New Component wizard is displayed.
Step 3 Type a unique name for the component you want to add. The name can be up to
20 characters in length and may include underscores or hyphens. Click Next.
The Assign Component window is displayed.
Step 4 From the Select a host to assign to drop-down list box, select a managed host
you want to assign the new component to. Click Next.
Step 5 Click Finish.
Step 6 Repeat for each component you want to add to your view.
Step 7 From the deployment editor menu, select File > Save to staging.
The deployment editor saves your changes to the staging area and automatically
closes.
Step 8 From the Admin interface menu, select Deploy Changes.
Connecting
Components
Once you add all the necessary components in your Event View, you must connect
your Event Processor(s) and Event Collector(s).
To connect components:
Step 1 In the Event View interface, select the component for which you want to establish a
connection.
Step 2 From the menu, select Actions > Add Connection.
NOTE
You can also right-click a component to access the Action menu item.
An arrow appears in your map. The arrow represents a connection between two
components.
Step 3 Drag the end of the arrow to the component you want to establish a connection to.
Table 7-3 provides a list of components you are able to connect.
STRM Log Manager Administration Guide
Building Your Event View
93
Table 7-3 Component Connections
You can connect a...
To
Connection Guide
Event Collector
Event Processor
An Event Collector can only be
connected to one Event Processor.
A Console Event Collector can only
be connected to a Console Event
Processor. This connection cannot
be removed.
A non-Console Event Collector can
be connected to an Event
Processor on the same system.
A non-Console Event Collector can
be connected to a remote Event
Processor, but only if the Event
Processor does not already exist
on the Console.
Event Collector
Off-site Target
The number of connections is not
restricted.
Off-site Source
Event Collector
The number of connections is not
restricted.
Event Processor
Event Processor
A Console Event Processor cannot
connect to a non-Console Event
Processor.
A non-Console Event Processor
can be connected to another
Console or non-Console Event
Processor, but not both at the
same time.
A non-Console Event Processor
will be connected to a Console
Event Processor when a
non-Console managed host is
added.
Step 4 Repeat for all remaining components that you want to establish a connection.
Step 5 Type a unique name for the source or target. The name can be up to 20 characters
in length and may include underscores or hyphens. Click Next.
The event source/target information window is displayed.
Step 6 Enter values for the parameters:
•
Enter a name for the off-site host - Type the name of the off-site host. The
name can be up to 20 characters in length and may only include numbers,
letters, underscores or hyphens.
•
Enter the IP address of the server - Type the IP address of the managed host
to which you want to connect.
STRM Log Manager Administration Guide
94
USING THE DEPLOYMENT EDITOR
•
Encrypt traffic from off-site source - Select the check box if you want to
encrypt traffic from an off-site source. To enable encryption, you must select
this check box on the associated off-site source and target.
Step 7 Click Next.
Step 8 Click Finish.
Step 9 Repeat for all remaining off-site sources and targets.
Step 10 From the main menu, select File > Save to staging.
NOTE
Forwarding
Normalized Events
If you update your Event Collector configuration or the monitoring ports, you must
manually update your source and target configurations to maintain the connection
between deployments.
To forward normalized events, you must configure an off-site Event Collector
(target) in your current deployment and the associated off-site Event Collector in
the receiving deployment (source).
You can add the following components to your Event View interface:
•
Off-site Source - An off-site Event Collector from which you want to receive
event data. The off-site source must be configured with appropriate
permissions to send event data to the off-site target.
•
Off-site Target - An off-site Event Collector to which you want to send event
data.
For example:
To forward normalized events between two deployments (A and B), where
deployment B wants to receive events from deployment A:
1 Configure deployment A with an off-site target to provide the IP address of the
managed host that includes Event Collector B.
2 Connect Event Collector A to the off-site target.
3 In deployment B, configure an off-site source with the IP address of the managed
host that includes Event Collector A and the port that Event Collector A is
monitoring.
If you want to disconnect the off-site source, you must remove the connections
from both deployments. From deployment A, remove the off-site target and in
deployment B, remove the off-site source.
To enable encryption between deployments, you must enable encryption on both
off-site source and target. Also, you must ensure the SSH public key for the off-site
source (client) is available to the target (server) to ensure appropriate access. For
example, if you want to enable encryption between the off-site source and Event
Collector B, you must copy the public key (located at /root/.ssh/id_rsa.pub) from
STRM Log Manager Administration Guide
Building Your Event View
95
the off-site source to Event Collector B (add the contents of the file to
/root/.ssh/authorized_keys).
Figure 7-1 Example of Connecting Deployments
NOTE
If the off-site source/target is an all-in-one system, the public key is not
automatically generated, therefore, you must manually generate the public key.
For more information on generating public keys, see your Linux documentation.
To forward normalized events:
Step 1 In the Admin interface, click Deployment Editor.
The Event View interface is displayed.
Step 2 In the Components panel, select one of the following options:
•
Off-site Source
•
Off-site Target
The Adding a New Component wizard is displayed.
Step 3 Type a unique name for the off-site source or off-site target. The name can be up
to 20 characters in length and may include underscores or hyphens. Click Next.
The Add a New Off-site Source window is displayed.
Step 4 Enter values for the parameters:
•
Enter a name for the off-site host - Type the name of the off-site host. The
name can be up to 20 characters in length and may include the underscores or
hyphens characters.
•
Enter the IP address of the source server - Type the IP address of the
managed host you want to connect the off-site host to.
STRM Log Manager Administration Guide
96
USING THE DEPLOYMENT EDITOR
•
Receive Events - Select the check box to enable the off-site host to receive
events.
•
Encrypt traffic from off-site source - Select the check box to encrypt traffic
from an off-site source. When enabling encryption, you must select this check
box on the associated off-site source and target.
Step 5 Click Next.
Step 6 Click Finish.
Step 7 Repeat for all remaining off-site sources and targets.
Step 8 From the deployment editor menu, select File > Save to staging.
The deployment editor saves your changes to the staging area and automatically
closes.
Step 9 From the Admin interface menu, select Advanced > Deploy Changes.
NOTE
Renaming
Components
If you update your Event Collector configuration, you must manually update your
source and target configurations to maintain the connection between
deployments.
You can rename a component in your view to uniquely identify components
through your deployment.
To rename a component:
Step 1 Select the component you want to rename.
Step 2 From the menu, select Actions > Rename Component.
NOTE
You can also right-click a component to access the Action menu items.
The Rename component window is displayed.
Step 3 Type a new name for the component. The name must be alphanumeric with no
special characters.
Step 4 Click OK.
Managing Your
System View
The System View interface allows you to manage all managed hosts in your
network. A managed host is a component in your network that includes STRM Log
Manager software. If you are using a STRM Log Manager appliance, the
components for that appliance model are displayed in the System View interface. If
your STRM Log Manager software is installed on your own hardware, the System
View interface includes a Host Context component. The System View interface
allows you to select which component(s) you want to run on each managed host.
Using the System View interface, you can:
•
Set up managed hosts in your deployment. See Setting Up Managed Hosts.
STRM Log Manager Administration Guide
Managing Your System View
•
•
97
Use STRM Log Manager with NATed networks in your deployment. See Using
NAT with STRM Log Manager.
Update the managed host port configuration. See Configuring a Managed
Host.
Setting Up Managed
Hosts
•
Assign a component to a managed host. See Assigning a Component to a
Host.
•
Configure Host Context. See Configuring Host Context.
•
Configure an Accumulator. See Configuring an Accumulator.
Using the deployment editor, you can manage all hosts in your deployment,
including:
•
Add a managed host to your deployment. See Adding a Managed Host.
•
Edit an existing managed host. See Editing a Managed Host.
•
Remove a managed host. See Removing a Managed Host.
You cannot add, assign or configure components on a non-Console managed host
when the STRM Log Manager software version is incompatible with the software
version that the Console is running. If a managed host has previously assigned
components and is running an incompatible software version, you can still view the
components, however, you are not able to update or delete the components. For
more information, contact Juniper Networks Customer Support.
NOTE
To enable SSH encryption between two managed hosts, each managed host
must be running at least STRM Log Manager 5.1.
Encryption provides greater security for all STRM Log Manager traffic between
managed hosts. To provide enhanced security, STRM Log Manager also provides
integrated support for OpenSSH and attachmateWRQ® Reflection SSH software.
Reflection SSH software provides a FIPS 140-2 certified encryption solution. When
integrated with STRM Log Manager, Reflection SSH provides secure
communication between STRM Log Manager components. For information on
Reflection SSH, see http://www.wrq.com/products.
NOTE
You must have Reflection SSH installed on each managed host you want to
encrypt using Reflection SSH. Also, Reflection SSH is not compatible with other
SSH software, such as, OpenSSH.
Encryption occurs between managed hosts in your deployment, therefore, your
deployment must consist of more than one managed host before encryption is
possible. Encryption is enabled using SSH tunnels (port forwarding) initiated from
the client. A client is the system that initiates a connection in a client/server
relationship. When encryption is enabled for a managed host, encryption tunnels
are created for all client applications on a managed host to provide protected
access to the respective servers. If you enable encryption on a non-Console
STRM Log Manager Administration Guide
98
USING THE DEPLOYMENT EDITOR
managed host, encryption tunnels are automatically created for databases and
other support service connections to the Console.
NOTE
Enabling encryption reduces the performance of a managed host by at least 50%.
Adding a Managed Host
To add a managed host:
NOTE
Before you add a managed host, make sure the managed host includes STRM
Log Manager software.
Step 1 From the menu, select Actions > Add a managed host.
The Add New Host wizard is displayed.
Step 2 Click Next.
The Enter the host’s IP window is displayed.
Step 3 Click Next.
The Enter the host’s IP window is displayed.
Step 4 Enter values for the parameters:
•
Enter the IP of the server or appliance to add - Type the IP address of the
host you want to add to your System View.
•
Enter the root password of the host - Type the root password for the host.
•
Confirm the root password of the host - Type the password again.
•
Host is NATed - Select the check box to use an existing Network Address
Translation (NAT) on this managed host. For more information on NAT, see
Using NAT with STRM Log Manager.
NOTE
If you want to enable NAT for a managed host, the NATed network must be using
static NAT translation. For more information on using NAT, see Using NAT with
STRM Log Manager.
•
Enable Encryption - Select the check box to create an SSH encryption tunnel
for the host. To enable encryption between two managed hosts, each managed
host must be running at least STRM Log Manager 5.1.
•
Enable Compression - Select the check box to enable data compression
between two managed hosts, each managed host must be running at least
STRM Log Manager 5.1.
If you selected the Host is NATed check box, the Configure NAT Settings window is
displayed. Go to Step 5. Otherwise, go to Step 6.
STRM Log Manager Administration Guide
Managing Your System View
NOTE
99
If you want to add a non-NATed managed host to your deployment when the
Console is NATed, you must change the Console to a NATed host (see Changing
the NAT Status for a Managed Host) before adding the managed host to your
deployment.
Step 5 To select a NATed network, enter values for the following parameters:
NOTE
•
Enter public IP of the server or appliance to add - Type the public IP
address of the managed host. The managed host uses this IP address to
communicate with other managed hosts in different networks using NAT.
•
Select NATed network - From the drop-down list box, select the network you
want this managed host to use.
-
If the managed host is on the same subnet as the Console, select the
Console of the NATed network.
-
If the managed host is not on the same subnet as the Console, select the
managed host of the NATed network.
For information on managing your NATed networks, see Using NAT with STRM
Log Manager.
Step 6 Click Next.
Step 7 Click Finish.
Step 8 From the main menu, select File > Save to staging.
NOTE
If your deployment included undeployed changes, a window is displayed to
request that you to deploy all changes.
Step 9 From the Admin interface menu, select Deploy Changes.
The System View is displayed with the host in the Managed Hosts panel.
Editing a Managed Host
To edit an existing managed host:
Step 1 Click the System View tab.
Step 2 Right-click the managed host you want to edit and select Edit Managed Host.
The Edit a managed host wizard is displayed.
NOTE
This option is only available when the selected component has a managed host
running a compatible version of STRM Log Manager software.
Step 3 Click Next.
The attributes window is displayed.
Step 4 Edit the following values, as necessary:
STRM Log Manager Administration Guide
100
USING THE DEPLOYMENT EDITOR
•
NOTE
Host is NATed - Select the check box if you want to use existing Network
Address Translation (NAT) on this managed host. For more information on NAT,
see Using NAT with STRM Log Manager.
If you want to enable NAT for a managed host, the NATed network must be using
static NAT translation. For more information on using NAT, see Using NAT with
STRM Log Manager.
•
Enable Encryption - Select the check box if you want to create an encryption
tunnel for the host.
If you selected the Host is NATed check box, the Configure NAT settings window is
displayed. Step 5. Otherwise, go to Step 6.
Step 5 To select a NATed network, enter values for the following parameters:
•
Enter public IP of the server or appliance to add - Type the public IP
address of the managed host. The managed host uses this IP address to
communicate with another managed host that belongs to a different network
using NAT.
•
Select NATed network - From the drop-down list box, select the network you
want this managed host to use. For information on managing your NATed
networks, see Using NAT with STRM Log Manager.
Step 6 Click Next.
Step 7 Click Finish.
Step 8 From the main menu, select File > Save to staging.
The System View interface is displayed, including the updated host in the
Managed Hosts panel.
Removing a Managed Host
You can remove non-Console managed hosts from your deployment. You cannot
remove a managed host that is hosting the STRM Log Manager Console.
To remove a managed host:
Step 1 Click the System View tab.
Step 2 Right-click the managed host you want to delete and select Remove host.
NOTE
This option is only available when the selected component has a managed host
running a compatible version of STRM Log Manager software.
A confirmation window is displayed.
Step 3 Click OK.
Step 4 From the Admin interface menu, select Advanced > Deploy Full Configuration.
STRM Log Manager Administration Guide
Managing Your System View
Using NAT with
STRM Log Manager
101
Network Address Translation (NAT) translates an IP address in one network to a
different IP address in another network. NAT provides increased security for your
deployment since requests are managed through the translation process and
essentially hides internal IP addresses.
Before you enable NAT for a STRM Log Manager managed host, you must set up
your NATed networks using static NAT translation. This ensures communications
between managed hosts that exist within different NATed networks.
NOTE
Your static NATed networks must be setup and configured on your network before
you enable NAT using STRM Log Manager. For more information, see your
network administrator.
You can add a non-NATed managed host using inbound NAT for a public IP
address. You can also use a dynamic IP address for outbound NAT. However, both
must be located on the same switch as the Console or managed host. You must
configure the managed host to use the same IP address for the public and private
IP addresses.
When adding or editing a managed host, you can enable NAT for that managed
host. You can also use the deployment editor to manage your NATed networks,
including:
•
Adding a NATed Network to STRM Log Manager
•
Editing a NATed Network
•
Deleting a NATed Network From STRM Log Manager
•
Changing the NAT Status for a Managed Host
Adding a NATed Network to STRM Log Manager
To add a NATed network to your STRM Log Manager deployment:
Step 1 In the deployment editor, click the NATed networks button
NOTE
.
You can also select the Actions > Manage NATed Networks menu option to
access the Manage NATed Networks window.
The Manage NATed Networks window is displayed.
Step 2 Click Add.
The Add New NATed Network window is displayed.
Step 3 Type a name for a network you want to use for NAT.
Step 4 Click OK.
The Manage NATed Networks window is displayed, including the added NATed
network.
Step 5 Click OK.
A confirmation window is displayed.
STRM Log Manager Administration Guide
102
USING THE DEPLOYMENT EDITOR
Step 6 Click Yes.
Editing a NATed Network
To edit a NATed network:
Step 1 In the deployment editor, click the NATed networks icon
NOTE
.
You can also select the Actions > Manage NATed Networks menu option to
access the Manage NATed Networks window.
The Manage NATed Networks window is displayed.
Step 2 Select the NATed network you want to edit. Click Edit.
The Edit NATed Network window is displayed.
Step 3 Type a new name for of the NATed network.
Step 4 Click OK.
The Manage NATed Networks window is displayed, including the updated NATed
networks.
Step 5 Click OK.
A confirmation window is displayed.
Step 6 Click Yes.
Deleting a NATed Network From STRM Log Manager
To delete a NATed network from your deployment:
Step 1 In the deployment editor, click the NATed networks icon
NOTE
.
You can also select the Actions > Manage NATed Networks menu option to
access the Manage NATed Networks window.
The Manage NATed Networks window is displayed.
Step 2 Select the NATed network you want to delete.
Step 3 Click Delete.
A confirmation window is displayed.
Step 4 Click OK.
Step 5 Click Yes.
Changing the NAT Status for a Managed Host
To change your NAT status for a managed host, make sure you update the
managed host configuration within STRM Log Manager before you update the
device. This prevents the host from becoming unreachable and allows you to
deploy changes to that host.
STRM Log Manager Administration Guide
Managing Your System View
103
To change the status of NAT (enable or disable) for an existing managed host:
Step 1 In the deployment editor, click the System View tab.
Step 2 Right-click the managed host you want to edit and select Edit Managed Host.
The Edit a managed host wizard is displayed.
Step 3 Click Next.
The Change the host’s networking and tunneling attributes window is displayed.
Step 4 Choose one of the following:
a
NOTE
If you want to enable NAT for the managed host, select the Host is NATed
check box and click Next. Go to Step 5.
If you want to enable NAT for a managed host, the NATed network must be using
static NAT translation.
b
If you want to disable NAT for the managed host, clear the Host is NATed
check box. Go to Step 6.
Step 5 To select a NATed network, enter values for the following parameters:
•
Change public IP of the server or appliance to add - Type the public IP
address of the managed host. The managed host uses this IP address to
communicate with another managed host that belongs to a different network
using NAT.
•
Select NATed network - From the drop-down list box, select the network you
want this managed host to use.
•
Manage NATs List - Click this icon to update the NATed network configuration.
For more information, see Using NAT with STRM Log Manager.
Step 6 Click Next.
Step 7 Click Finish.
The System View interface is displayed, including the updated host in the
Managed Hosts panel.
NOTE
Once you change the NAT status for an existing managed host, error messages
may be displayed. Ignore these error messages.
Step 8 Update the configuration for the device (firewall) to which the managed host is
communicating.
Step 9 From the Admin interface menu, select Advanced > Deploy Full Configuration.
Configuring a
Managed Host
To configure a managed host:
Step 1 From the System View interface, right-click the managed host you want to
configure and select Configure.
The Configure host window is displayed.
STRM Log Manager Administration Guide
104
USING THE DEPLOYMENT EDITOR
Step 2 Enter values for the parameters:
•
Minimum port allowed - Type the minimum port for which you want to
establish communications.
•
Maximum port allowed - Type the maximum port for which you want to
establish communications.
•
Ports to exclude - Type the port(s) you want to exclude from communications.
Separate multiple ports using a comma.
Step 3 Click Save.
Assigning a
Component to a Host
NOTE
You can assign the STRM Log Manager components that you added in the Event
View interfaces to the managed hosts in your deployment.
This section provides information on assigning a component to a host using the
System View interface, however, you can also assign components to a host in the
Event View interface.
To assign a host:
Step 1 Click the System View tab.
Step 2 From the Managed Host list, select the managed host you want to assign a STRM
Log Manager component to.
The System View of the host is displayed.
Step 3 Select the component you want to assign to a managed host.
Step 4 From the menu, select Actions > Assign.
NOTE
You can also right-click a component to access the Actions menu items.
The Adding a new component wizard is displayed.
Step 5 From the Select a host drop-down list box, select the host that you want to assign
to this component. Click Next.
NOTE
The drop-down list box only displays managed hosts that are running a
compatible version of STRM Log Manager software.
Step 6 Click Finish.
STRM Log Manager Administration Guide
Managing Your System View
Configuring Host
Context
105
The Host Context component monitors all STRM Log Manager components to
make sure that each component is operating as expected.
To configure Host Context:
To configure the Host Context component:
Step 1 In the deployment editor, click the System View tab.
The System View interface is displayed.
Step 2 Select the managed host that includes the host context you want to configure.
Step 3 Select the Host Context component.
Step 4 From the menu, select Actions > Configure.
NOTE
You can also right-click a component to access the Actions menu item.
The Host Context Configuration window is displayed.
Step 5 Enter values for the parameters:
Table 7-4 Host Context Parameters
Parameter
Description
Disk Usage Sentinal Settings
Warning Threshold
When the configured threshold of disk usage is exceeded,
an email is sent to the administrator indicating the current
state of disk usage. The default warning threshold is 0.75,
therefore, when disk usage exceeds 75%, an email is sent
indicating that disk usage is exceeding 75%. If disk usage
continues to increase above the configured threshold, a new
email is sent after every 5% increase in usage. By default,
Host Context monitors the following partitions for disk usage:
•
/
•
/store
•
/store/tmp
Type the warning threshold for disk usage.
Note: Notification emails are sent from the email address
specified in the Alert Email From Address parameter to
the email address specified in the Administrative Email
Address parameter. These parameters are configured in
the System Settings interface. For more information, see
Chapter 5 - Setting Up STRM Log Manager.
STRM Log Manager Administration Guide
106
USING THE DEPLOYMENT EDITOR
Table 7-4 Host Context Parameters (continued)
Parameter
Description
Recovery Threshold
Once the system has exceeded the shutdown threshold,
disk usage must fall below the recovery threshold before
STRM Log Manager processes are restarted. The default is
0.92, therefore, processes will not be restarted until the disk
usage is below 92%.
Type the recovery threshold.
Note: Notification emails are sent to the Administrative
Email Address and are sent from the Alert Email From
Address, which is configured in the System Settings. For
more information, see Chapter 5 - Setting Up STRM
Log Manager.
Shutdown Threshold
Once the system has exceeded the shutdown threshold,
disk usage must fall below the recovery threshold before
STRM Log Manager processes are restarted. The default is
0.90, therefore, processes are not restarted until disk usage
is below 90%.
Type the recovery threshold.
Note: Notification emails are sent from the email address
specified in the Alert Email From Address parameter to
the email address specified in the Administrative Email
Address parameter. These parameters are configured in
the System Settings interface. For more information, see
Chapter 5 - Setting Up STRM Log Manager.
Inspection Interval
Type the frequency, in milliseconds, that you want to
determine disk usage.
SAR Sentinel Settings
Inspection Interval
Type the frequency, in milliseconds, that you want to inspect
SAR output. The default is 300,000 ms.
Alert Interval
Type the frequency, in milliseconds, that you want to be
notified that the thresholds have been exceeded. The default
is 7,200,000 ms.
Time Resolution
Type the time, in seconds, that you want the SAR inspection
to be engaged. The default is 60 seconds.
Log Monitor Settings
Inspection Interval
Type the frequency, in milliseconds, that you want to monitor
the log files. The default is 60,000 ms.
Monitored SYSLOG
File Name
Type a filename for the SYSLOG file. The default is
/var/log/qradar.error.
Alert Size
Type the maximum number of lines you want to monitor from
the log file. The default is 1000.
Step 6 Click Save.
The System View interface is displayed.
STRM Log Manager Administration Guide
Managing Your System View
Configuring an
Accumulator
107
The accumulator component assists with data collection and anomaly detection for
the Event Processor on a managed host. The accumulator component is
responsible for receiving streams events from the local Event Processor, writing
database data, and contains the Anomaly Detection Engine (ADE).
To configure an accumulator:
Step 1 In the deployment editor, click the System View tab.
The System View interface is displayed.
Step 2 Select the managed host you want to configure.
Step 3 Select the accumulator component.
Step 4 From the menu, select Actions > Configure.
NOTE
You can also right-click a component to access the Actions menu item.
The Accumulator Configuration window is displayed.
Table 7-5 Accumulator Parameters
Parameter
Description
Central Accumulator
Specifies if the current component is a central accumulator.
A central accumulator only exists on a Console system.
Options include:
Streamer Accumulator
Listen Port
•
True - Specifies that the component is a central
accumulator on the Console and receives TCP data from
non-central accumulators.
•
False - Specifies that the component is not a central
accumulator, but is deployed on the Event Processor and
forwards data to a central accumulator on the Console.
Type the listen port of the accumulator responsible for
receiving streams of events from the event processor.
The default value is 7802.
Alerts DSM Address
Type the DSM address for forwarding alerts from the
accumulator using the following syntax: <DSM_IP
address>:<DSM port number>.
Step 5 Click Save.
The System View interface is displayed.
STRM Log Manager Administration Guide
108
USING THE DEPLOYMENT EDITOR
Configuring STRM
Log Manager
Components
Configuring an Event
Collector
This section provides information on configuring STRM Log Managercomponents,
including:
•
Configuring an Event Collector
•
Configuring an Event Processor
•
Configuring an Off-site Source
•
Configuring an Off-site Target
his section provides information on how to configure an Event Collector. For an
overview of the Event Collector component, see Building Your Event View.
To configure an Event Collector:
Step 1 From either the Event View or System View interfaces, select the Event Collector
you want to configure.
Step 2 From the menu, select Actions > Configure.
NOTE
You can also right-click a component to access the Action menu items.
The Event Collector Configuration window is displayed.
Step 3 Enter values for the parameters:
Table 7-6 Event Collector Parameters
Parameter
Description
Destination Event
Processor
Type the destination Event Processor for
communications.
Event Forwarding Listen
Port
Type the listening port for event forwarding to other
non-Console.
Step 4 In the toolbar, click Advanced to display the advanced parameters.
The advanced configuration parameters are displayed.
Step 5 Enter values for the parameters:
Table 7-7 Event Collector Advanced Parameters
Parameter
Description
Primary Collector
Specifies one of the following values:
•
True - Specifies that the Event Collector is located on a
Console system.
•
False - Specifies that the Event Collector is located on a
non-Console system.
STRM Log Manager Administration Guide
Configuring STRM Log Manager Components
109
Table 7-7 Event Collector Advanced Parameters (continued)
Parameter
Description
Auto Detection
Enabled
Type of the following values:
•
Yes - Enables the Event Collector to automatically
analyze and accept traffic from previously unknown log
sources. The appropriate firewall ports are opened to
enable Autodetection to receive events. This is the
default.
•
No - Prevents the Event Collector from automatically
analyzing and accepting traffic from previously unknown
log sources.
For more information on configuring log sources, see the
Managing Log Sources Guide.
Destination Event
Processor
Type the destination Event Processor for events if current
Event Processor is not the Primary Collector.
The connection to the Destination Event Processor is shown
as <Destination Event Processor IP Address>:32005.
Step 6 Click Save.
The deployment editor is displayed.
Step 7 Repeat for all Event Collectors in your deployment you want to configure.
Configuring an Event
Processor
This section provides information on how to configure an Event Processor. For an
overview of the Event Processor component, see Building Your Event View.
To configure an Event Processor:
Step 1 From either the Event View or System View interfaces, select the Event Processor
you want to configure.
Step 2 From the menu, select Actions > Configure.
NOTE
You can also right-click a component to access the Action menu items.
The Event Processor Configuration window is displayed.
Step 3 Enter values for the parameters:
Table 7-8 Event Processor Parameters
Parameter
Description
Event Collector
Type the port that the Event Processor monitors for
Connections Listen Port incoming Event Collector connections. The default value is
port 32005.
Event Processor
Type the port that the Event Processor monitors for
Connections Listen Port incoming Event Processor connections. The default value
is port 32007.
Step 4 In the toolbar, click Advanced to display the advanced parameters.
STRM Log Manager Administration Guide
110
USING THE DEPLOYMENT EDITOR
The advanced configuration parameters are displayed.
Step 5 Enter values for the parameters, as necessary:
Table 7-9 Event Processor Parameters
Parameter
Description
Overflow Routing
Threshold
Type the events per second threshold that the Event
Processor can manage events. Events over this
threshold are placed in the cache.
Test Rules
Note: The test rules drop-down list box in the
Deployment Editor is available for non-Console
Event Processors only.
Type one of the following options:
•
Locally - Rules are tested on the Event Processor
and not shared with the system. Testing rules locally
is the default for Console Event Processors.
•
Globally - Allows individual rules for every Event
Processor to be shared and tested system wide.
Each rule can be toggled to Global for detection by
any Event Processor on the system.
Note: If a rule is configured to test locally, the Globally
option does not override the rule’s setting.
For example, you create rule to alert you when there is
five failed login attempts within 5 minutes. The default
for the rule is set to local. When the Event Processor
containing the local rule observes five failed login
attempts, the rule generates a response. When the rule
in the example above is set to Global, when five failed
login attempts within 5 minutes is detected on any Event
Processor, the rule generates a response. This means
that when rules are shared globally, the rule can detect
when one failed login attempt comes from five separate
event processors. Testing rules globally is the default for
non-Console Event Processors, with each rule on the
Event Processor set to test locally.
Overflow Routing
Threshold
Type the events per second threshold that the Event
Processor can manage. Events over this threshold are
placed in the cache.
Events database path
Type the location you want to store events. The default
is /store/ariel/events.
Payloads database path
Type the location you want to store payload information.
The default is /store/ariel/payloads.
Step 6 Click Save.
The deployment editor is displayed.
Step 7 Repeat for all Event Processors in your deployment you want to configure.
STRM Log Manager Administration Guide
Configuring STRM Log Manager Components
Configuring an
Off-site Source
NOTE
111
This section provides information on how to configure an off-site source. For an
overview of the off-site source component, see Building Your Event View.
When configuring off-site source and target components, we recommend that you
deploy the Console with the off-site source first and the Console with the off-site
target second to prevent connection errors.
To configure an off-site source component:
Step 1 From either the Event View or System View interfaces, select the off-site source
you want to configure.
Step 2 From the menu, select Actions > Configure.
NOTE
You can also right-click a component to access the Action menu items.
The Off-site Source Configuration window is displayed.
Step 3 Enter values for the parameters:
Table 7-10 Off-site Source Parameters
Parameter
Description
Receive Events
Type one of the following values:
•
True - Enables the system to receive events from the
off-site source host.
•
False - Prevents the system from receiving events from
the off-site source host.
Step 4 Click Save.
The deployment editor is displayed.
Step 5 Repeat for all off-site sources in your deployment you want to configure.
Configuring an
Off-site Target
NOTE
This section provides information on how to configure an off-site target. For an
overview of the off-site target component, see Building Your Event View.
When configuring off-site source and target components, we recommend that you
deploy the Console with the off-site source first and the Console with the off-site
target second to prevent connection errors.
To configure an off-site target component:
Step 1 From either the Event View or System View interfaces, select the off-site target you
want to configure.
Step 2 From the menu, select Actions > Configure.
NOTE
You can also right-click a component to access the Action menu items.
STRM Log Manager Administration Guide
112
USING THE DEPLOYMENT EDITOR
The Off-site Target Configuration window is displayed.
Step 3 Enter values for the parameters:
Table 7-11 Off-site Target Parameters
Parameter
Description
Event Collector Listen
Port
Type the Event Collector listen port for receiving event
data. The default listen port for events is 32004.
If the off-site target system has been upgraded from a
previous STRM Log Manager software version, you must
change the port from the default (32004) to the port
specified in the Event Forwarding Listen Port parameter
for the off-site target. For more information on how to
access the Event Forwarding Listen port on the off-site
target, see Configuring an Event Collector.
Step 4 Click Save.
STRM Log Manager Administration Guide
8
FORWARDING SYSLOG DATA
STRM Log Manager allows you to forward received log data to other products. You
can forward syslog data (raw log data) received from devices as well as STRM Log
Manager normalized event data. You can forward data on a per Event
Collector/Event Processor basis and you can configure multiple forwarding
destinations. Also, STRM Log Manager ensures that all data that is forwarded is
unaltered.
This chapter includes:
Adding a Syslog
Destination
•
Adding a Syslog Destination
•
Editing a Syslog Destination
•
Delete a Syslog Destination
To add a syslog forwarding destination:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click Data Sources.
The Data Sources panel is displayed.
Step 3 Click the Syslog Forwarding Destinations icon.
The Syslog Forwarding Destinations window is displayed.
Step 4 Click Add.
The Syslog Forwarding Destinations window is displayed.
Step 5 Enter values for the parameters:
•
Forwarding Event Collector - From the drop-down list box, select the
deployed Event Collector from which you want to forward log data.
•
IP - Type the IP address of the system to which you want to forward log data.
•
Port - Type or select the port number on the system to which you want to
forward log data.
Step 6 Click Save.
STRM Log Manager Administration Guide
114
FORWARDING SYSLOG DATA
Editing a Syslog
Destination
To edit a syslog forwarding destination:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the Syslog Forwarding Destinations icon.
The Syslog Forwarding Destinations window is displayed.
Step 4 Select the entry you want to edit.
Step 5 Click Edit.
The Syslog Forwarding Destinations window is displayed.
Step 6 Update values, as necessary:
•
Forwarding Event Collector - From the drop-down list box, select the
deployed Event Collector from which you want to forward log data.
•
IP - Type the IP address of the system to which you want to forward log data.
•
Port - Type or select the port number on the system to which you want to
forward log data.
Step 7 Click Save.
Delete a Syslog
Destination
To delete a syslog forwarding destination:
Step 1 Click the Admin tab.
Step 2 In the navigation menu, click System Configuration.
The System Configuration panel is displayed.
Step 3 Click the Syslog Forwarding Destinations icon.
The Syslog Forwarding Destinations window is displayed.
Step 4 Select the entry you want to delete.
Step 5 Click Delete.
A confirmation window is displayed.
Step 6 Click OK.
STRM Log Manager Administration Guide
A
JUNIPER NETWORKS MIB
This appendix provides information on the Juniper Networks Management
Information Base (MIB). The Juniper Networks MIB allows you to send SNMP
traps to other network management systems. The Juniper Networks OID is
1.3.6.1.4.1.20212.
NOTE
For assistance with the Juniper Networks MIB, please contact Juniper Networks
Customer Support.
The Juniper Networks MIB includes:
Q1LABS-MIB DEFINITIONS ::= BEGIN
IMPORTS
OBJECT-TYPE, NOTIFICATION-TYPE, MODULE-IDENTITY, Integer32,
Opaque, enterprises, Counter32 FROM SNMPv2-SMI
DisplayString FROM SNMPv2-TC;
q1Labs MODULE-IDENTITY
LAST-UPDATED "200804110000Z"
ORGANIZATION "Q1 Labs Inc"
CONTACT-INFO
"
890 Winter Street
Suite 230
Waltham, MA 02451 USA
Phone: 781-250-5800
email: [email protected]
"
DESCRIPTION
"Q1 Labs MIB Definition"
::= { enterprises 20212 }
notifications
OBJECT IDENTIFIER ::= { q1Labs 1 }
STRM Log Manager Administration Guide
116
JUNIPER NETWORKS MIB
properties
OBJECT IDENTIFIER ::= { q1Labs 2 }
customProperties
OBJECT IDENTIFIER ::= { q1Labs 3 }
-- Notifications
eventCRENotification NOTIFICATION-TYPE
STATUS current
DESCRIPTION "QRADAR's Event CRE Notification"
::= { notifications 1 }
offenseCRENotification NOTIFICATION-TYPE
STATUS current
DESCRIPTION "QRADAR's Offense CRE Notification"
::= { notifications 2 }
-- Properties
-- Misc Properties
localHostAddress OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "IP address of the local machine where the
notification originated"
::= { properties 1 }
timeString OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..64))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Time offense was created or time the event rule
fired. Example 'Mon Apr 28 10:14:49 GMT 2008'"
::= { properties 2 }
timeInMillis OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Time offense was created or time the event rule
fired in milliseconds"
::= { properties 3 }
-- Offense Properties
offenseID OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS accessible-for-notify
STATUS current
STRM Log Manager Administration Guide
117
DESCRIPTION "Offense ID"
::= { properties 4 }
offenseName OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..256))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Name of the Offense"
::= { properties 5 }
offenseDescription OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..1024))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Description of the Offense"
::= { properties 6 }
offenseLink OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..1024))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "HTTP link to the offense"
::= { properties 7 }
magnitude OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Offense magnitude"
::= { properties 8 }
severity OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Offense severity"
::= { properties 9 }
creditibility OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Offense creditibility"
::= { properties 10 }
STRM Log Manager Administration Guide
118
JUNIPER NETWORKS MIB
relevance OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Offense relevance"
::= { properties 11 }
-- Attacker Properties
attackerIP OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Attacker IP"
::= { properties 12 }
attackersUserName OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..1024))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Attacker's User Name"
::= { properties 13 }
attackerCount OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Total Number of Attackers"
::= { properties 14 }
top5AttackerIPs OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..1024))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Top 5 Attackers by Magnitude(comma separated)"
::= { properties 15 }
topAttackerIP OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Top Attacker IPs"
::= { properties 16 }
top5AttackerUsernames OBJECT-TYPE
STRM Log Manager Administration Guide
119
SYNTAX DisplayString (SIZE(0..1024))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Top 5 Attackers by Magnitude(comma separated)"
::= { properties 48 }
topAttackerUsername OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..32))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Top Attacker IPs"
::= { properties 49 }
attackerNetworks OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..1024))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Attacker Networks(comma separated)"
::= { properties 17 }
-- Target Properties
targetIP OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Target IP"
::= { properties 18 }
targetsUserName OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..64))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Target's User Name"
::= { properties 19 }
targetCount OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Total Number of Targets"
::= { properties 20 }
top5TargetIPs OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..1024))
STRM Log Manager Administration Guide
120
JUNIPER NETWORKS MIB
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Top 5 Target IPs by Magnitude"
::= { properties 21 }
topTargetIP OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Top Target"
::= { properties 22 }
top5TargetUsernames OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..1024))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Top 5 Target IPs by Magnitude"
::= { properties 50 }
topTargetUsername OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..32))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Top Target"
::= { properties 51 }
targetNetworks OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..1024))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Target Networks(comma separated)"
::= { properties 23 }
-- Category properties
categoryCount OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Total Number of Categories"
::= { properties 24 }
top5Categories OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..1024))
MAX-ACCESS accessible-for-notify
STRM Log Manager Administration Guide
121
STATUS current
DESCRIPTION "Top 5 Categories(comma separated)"
::= { properties 25 }
topCategory OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..64))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Top Category"
::= { properties 26 }
categoryID OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Category ID of Event that triggered the Event
CRE Rule"
::= { properties 27 }
category OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..64))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Category of the Event that triggered the Event
CRE Rule"
::= { properties 28 }
-- Annontation Properties
annotationCount OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Total Number of Annotations"
::= { properties 29 }
topAnnotation OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..1024))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Top Annotation"
::= { properties 30 }
-- Rule Properties
ruleCount OBJECT-TYPE
STRM Log Manager Administration Guide
122
JUNIPER NETWORKS MIB
SYNTAX Integer32
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Total Number of Rules contained in the
Offense"
::= { properties 31 }
ruleNames OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..1024))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Names of the Rules that contributed to the
Offense(comma separated)"
::= { properties 32 }
ruleID OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "ID of the Rule that was triggered in the CRE"
::= { properties 33 }
ruleName OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..256))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Name of the Rules that was triggered in the
CRE"
::= { properties 34 }
ruleDescription OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..1024))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Description/Notes of the Rules that was
triggered in the CRE"
::= { properties 35 }
-- Event Properties
eventCount OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS accessible-for-notify
STATUS current
STRM Log Manager Administration Guide
123
DESCRIPTION "Total Number of Events contained in the
Offense"
::= { properties 36 }
eventID OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "ID of the Event that triggered the Event CRE
Rule"
::= { properties 37 }
qid OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "QID of the Event that triggered the Event CRE
Rule"
::= { properties 38 }
eventName OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..256))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Name of the Event that triggered the Event CRE
Rule"
::= { properties 39 }
eventDescription OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..1024))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Description/Notes of the Event that triggered
the Event CRE Rule"
::= { properties 40 }
-- IP Properties
sourceIP OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Source IP of the Event that triggered the
Event CRE Rule"
::= { properties 41 }
STRM Log Manager Administration Guide
124
JUNIPER NETWORKS MIB
sourcePort OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Source Port of the Event that triggered the
Event CRE Rule"
::= { properties 42 }
destinationIP OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Destination IP of the Event that triggered the
Event CRE Rule"
::= { properties 43 }
destinationPort OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Destination Port of the Event that triggered
the Event CRE Rule"
::= { properties 44 }
protocol OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Protocol of the Event that triggered the Event
CRE Rule"
::= { properties 45 }
attackerPort OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Source Port of the Event that triggered the
Event CRE Rule"
::= { properties 46 }
targetPort OBJECT-TYPE
SYNTAX Integer32
MAX-ACCESS accessible-for-notify
STATUS current
STRM Log Manager Administration Guide
125
DESCRIPTION "Destination Port of the Event that triggered
the Event CRE Rule"
::= { properties 47 }
-- =====================
-- *** Obselete OIDs ***
-- =====================
q1NotificationData OBJECT-TYPE
SYNTAX DisplayString (SIZE(0..1024))
MAX-ACCESS accessible-for-notify
STATUS current
DESCRIPTION "Notification Data"
::= { q1Labs 100 }
q1NotificationsOBJECT IDENTIFIER
::= { q1Labs 200 }
q1CRENotification NOTIFICATION-TYPE
STATUS current
DESCRIPTION "QRADAR's Custom Rule Engine Notification"
::= { q1Notifications 0 }
q1EventRuleNotification NOTIFICATION-TYPE
STATUS current
DESCRIPTION "Notification Triggered by a QRADAR Custom
Event Rule"
::= { q1Notifications 1 }
q1OffenseRuleNotification NOTIFICATION-TYPE
STATUS current
DESCRIPTION "Notification Triggered by a QRADAR Custom
Offense Rule"
::= { q1Notifications 2 }
q1SentryNotification NOTIFICATION-TYPE
STATUS current
DESCRIPTION "Notification Triggered by a QRADAR Sentry"
::= { q1Notifications 3 }
END
STRM Log Manager Administration Guide
B
VIEWING AUDIT LOGS
Changes made by STRM Log Manager users are recorded in the audit logs. You
can view the audit logs to monitor changes to STRM Log Manager and the users
performing those changes.
All audit logs are stored in plain text and are archived and compressed once the
audit log file reaches a size of 200 MB. The current log file is named audit.log.
Once the file reaches a size of 200 MB, the file is compressed and renamed as
follows: audit.1.gz, audit.2.gz, etc with the file number incrementing each
time a log file is archived. STRM Log Manager stores up to 50 archived log files.
This appendix provides information on using the audit logs, including:
Logged Actions
•
Logged Actions
•
Viewing the Log File
STRM Log Manager logs the following categories of actions in the audit log file:
NOTE
You can view audit log events using the Log Activity interface. Table B-1 provides
a record of the logged actions.
Table B-1 Logged Actions
Category
Action
Administrator Authentication
Log in to the Admin interface.
Log out of the Admin interface.
Assets
Delete all assets.
STRM Log Manager Administration Guide
128
VIEWING AUDIT LOGS
Table B-1 Logged Actions (continued)
Category
Action
Backup and Recovery
Edit the configuration.
Initiate the backup.
Complete the backup.
Fail the backup.
Delete the backup.
Synchronize the backup.
Cancel the backup.
Initiate the restore.
Upload a backup.
Upload an invalid backup.
Delete the backup.
Purge the backup.
Chart Configuration
Save event chart configuration.
Custom Properties
Add a custom event property.
Edit a custom event property.
Delete a custom property.
Custom Property Expressions Add a custom event property expression.
Edit a custom event property expression.
Delete a custom event property expression.
Event Retention Buckets
Add a bucket.
Delete a bucket.
Edit a bucket.
Enable or disable a bucket.
Groups
Add a group.
Delete a group.
Edit a group.
High Availability
Add an HA host.
Remove an HA host.
Set an HA system offline.
Set an HA system online.
Restore an HA system.
Installation
Install a .rpm package, such as a DSM update.
License
Add a license key.
Edit a license key.
STRM Log Manager Administration Guide
Logged Actions
129
Table B-1 Logged Actions (continued)
Category
Action
Log Sources
Add a log source.
Edit a log source.
Delete a log source.
Add a log source group.
Edit a log source group.
Delete a log source group.
Edit the DSM parsing order.
Log Source Extension
Add an log source extension.
Edit the log source extension.
Delete a log source extension.
Upload a log source extension.
Upload a log source extension successfully.
Upload an invalid log source extension.
Download a log source extension.
Report a log source extension.
Modify a log sources association to a log source or
log source type.
Protocol Configuration
Add a protocol configuration.
Delete a protocol configuration.
Edit a protocol configuration.
QIDmap
Add a QID map entry.
Edit a QID map entry.
Reference Sets
Create a reference set.
Edit a reference set.
Purge elements in a reference set.
Delete a reference set.
Reports
Add a template.
Delete a template.
Edit a template.
Execute a template.
Delete a report.
Delete generated content.
View a generated report.
Email a generated report.
Root Login
Log in to STRM Log Manager, as root.
Log out of STRM Log Manager, as root.
STRM Log Manager Administration Guide
130
VIEWING AUDIT LOGS
Table B-1 Logged Actions (continued)
Category
Action
Rules
Add a rule.
Delete a rule.
Edit a rule.
Session Authentication
Create a new administration session.
Terminate an administration session.
Deny an invalid authentication session.
Expire a session authentication.
Create an authentication session.
Terminate an authentication session.
System Management
Shutdown a system.
Restart a system.
User Authentication
Log in to STRM Log Manager.
Log out of STRM Log Manager.
User Authentication Ariel
Deny a login attempt.
Add an Ariel property.
Delete an Ariel property.
Edit an Ariel property.
Add an Ariel property extension.
Delete an Ariel property extension.
Edit an Ariel property extension.
User Accounts
Add an account.
Edit an account.
Delete an account.
User Roles
Add a role.
Edit a role.
Delete a role.
Viewing the Log
File
To view the audit logs:
Step 1 Log in to STRM Log Manager as root.
Step 2 Go to the following directory:
/var/log/audit
Step 3 Open the desired audit log file.
Each entry in the log file displays using the following format:
STRM Log Manager Administration Guide
Viewing the Log File
NOTE
131
The maximum size of any audit message (not including date, time, and host
name) is 1024 characters.
<date_time> <host name> <user>@<IP address> (thread ID)
[<category>] [<sub-category>] [<action>] <payload>
Where:
<date_time> is the date and time of the activity in the format: Month Date
HH:MM:SS.
<host name> is the host name of the Console where this activity was logged.
<user> is the name of the user that performed the action.
<IP address> is the IP address of the user that performed the action.
(thread ID) is the identifier of the Java thread that logged this activity.
<category> is the high-level category of this activity.
<sub-category> is the low-level category of this activity.
<action> is the activity that occurred.
<payload> is the complete record that has changed, if any. This may include a
user record or an event rule.
For example:
Nov 6 12:22:31 localhost.localdomain [email protected]
(Session) [Authentication] [User] [Login]
Nov 6 12:22:31 localhost.localdomain [email protected] (0)
[Configuration] [User Account] [Account Modified]
username=james, password=/oJDuXP7YXUYQ, networks=ALL,
[email protected], userrole=Admin
STRM Log Manager Administration Guide
C
EVENT CATEGORIES
This document provides information on the types of event categories and the
processing of events. This document provides information on event categories,
including:
NOTE
•
High-Level Event Categories
•
Recon
•
DoS
•
Authentication
•
Access
•
Exploit
•
Malware
•
Suspicious Activity
•
System
•
Policy
•
CRE
•
Potential Exploit
•
SIM Audit
•
Audit
The Risk high-level category is only displayed in the interface when STRM Risk
Manager is installed.
STRM Log Manager Administration Guide
134
EVENT CATEGORIES
High-Level Event
Categories
The high-level event categories include:
Table C-1 High-Level Event Categories
Category
Description
Recon
Events relating to scanning and other techniques used to identify
network resources, for example, network or host port scans.
DoS
Events relating to Denial of Service (DoS) or Distributed Denial of
Service (DDoS) attacks against services or hosts, for example,
brute force network DoS attacks.
Authentication
Events relating to authentication controls, group, or privilege
change, for example, log in or log out.
Access
Events resulting from an attempt to access network resources,
for example, firewall accept or deny.
Exploit
Events relating to application exploits and buffer overflow
attempts, for example, buffer overflow or web application
exploits.
Malware
Events relating to viruses, trojans, back door attacks, or other
forms of hostile software. This may include a virus, trojan,
malicious software, or spyware.
Suspicious
Activity
The nature of the threat is unknown but behavior is suspicious
including protocol anomalies that potentially indicate evasive
techniques, for example, packet fragmentation or known IDS
evasion techniques.
System
Events related to system changes, software installation, or status
messages.
Policy
Events regarding corporate policy violations or misuse.
CRE
Events generated from an event rule. For more information on
creating custom rules, see the STRM Log Manager Users Guide.
Potential Exploit Events relating to potential application exploits and buffer
overflow attempts.
Recon
SIM Audit
Events relating to user interaction with the Console and
administrative functions.
Audit
Events relating to audit activity in STRM Log Manager.
The Recon category indicates events relating to scanning and other techniques
used to identify network resources. The associated low-level event categories
include:
Table C-2 Recon Categories
Low Level Event
Category
Unknown Form of Recon
Description
Indicates an unknown form of
reconnaissance.
STRM Log Manager Administration Guide
Severity Level
(0 to 10)
2
Recon
135
Table C-2 Recon Categories (continued)
Low Level Event
Category
Description
Severity Level
(0 to 10)
Application Query
Indicates reconnaissance to
applications on your system.
3
Host Query
Indicates reconnaissance to a host in
your network.
3
Network Sweep
Indicates reconnaissance on your
network.
4
Mail Reconnaissance
Indicates reconnaissance on your mail
system.
3
Windows Reconnaissance Indicates reconnaissance for windows. 3
Portmap / RPC Request
Indicates reconnaissance on your
portmap or RPC request.
3
Host Port Scan
Indicates a scan occurred on the host’s 4
ports.
RPC Dump
Indicates Remote Procedure Call
(RPC) information is removed.
3
DNS Reconnaissance
Indicates reconnaissance on the DNS
server.
3
Misc Reconnaissance
Event
Indicates a miscellaneous
reconnaissance event.
2
Web Reconnaissance
Indicates web reconnaissance on your
network.
3
Database Reconnaissance Indicates database reconnaissance on 3
your network.
ICMP Reconnaissance
Indicates reconnaissance on ICMP
traffic.
3
UDP Reconnaissance
Indicates reconnaissance on UDP
traffic.
3
SNMP Reconnaissance
Indicates reconnaissance on SNMP
traffic.
3
ICMP Host Query
Indicates an ICMP host query.
3
UDP Host Query
Indicates a UDP host query.
3
NMAP Reconnaissance
Indicates NMAP reconnaissance.
3
TCP Reconnaissance
Indicates TCP reconnaissance on your 3
network.
Unix Reconnaissance
Indicates reconnaissance on your
UNIX network.
3
FTP Reconnaissance
Indicates FTP reconnaissance.
3
STRM Log Manager Administration Guide
136
DoS
EVENT CATEGORIES
The DoS category indicates events relating to Denial Of Service (DoS) attacks
against services or hosts. The associated low-level event categories include:
Table C-3 DoS Categories
Low Level Event
Category
Description
Severity Level
(0 to 10)
Unknown DoS Attack
Indicates an unknown DoS attack.
8
ICMP DoS
Indicates an ICMP DoS attack.
9
TCP DoS
Indicates a TCP DoS attack.
9
UDP DoS
Indicates a UDP DoS attack.
9
DNS Service DoS
Indicates a DNS service DoS attack.
8
Web Service DoS
Indicates a web service DoS attack.
8
Mail Service DoS
Indicates a mail server DoS attack.
8
Distributed DoS
Indicates a distributed DoS attack.
9
Misc DoS
Indicates a miscellaneous DoS attack.
8
Unix DoS
Indicates a Unix DoS attack.
8
Windows DoS
Indicates a Windows DoS attack.
8
Database DoS
Indicates a database DoS attack.
8
FTP DoS
Indicates an FTP DoS attack.
8
Infrastructure DoS
Indicates a DoS attack on the
infrastructure.
8
Telnet DoS
Indicates a Telnet DoS attack.
8
Brute Force Login
Indicates access to your system
through unauthorized methods.
8
High Rate TCP DoS
Indicates a high rate TCP DoS attack.
8
High Rate UDP DoS
Indicates a high rate UDP DoS attack.
8
High Rate ICMP DoS
Indicates a high rate ICMP DoS attack. 8
High Rate DoS
Indicates a high rate DoS attack.
8
Medium Rate TCP DoS
Indicates a medium rate TCP attack.
8
Medium Rate UDP DoS
Indicates a medium rate UDP attack.
8
Medium Rate ICMP DoS
Indicates a medium rate ICMP attack.
8
Medium Rate DoS
Indicates a medium rate DoS attack.
8
Medium Rate DoS
Indicates a medium rate DoS attack.
8
Low Rate TCP DoS
Indicates a low rate TCP DoS attack.
8
Low Rate UDP DoS
Indicates a low rate UDP DoS attack.
8
Low Rate ICMP DoS
Indicates a low rate ICMP DoS attack.
8
Low Rate DoS
Indicates a low rate DoS attack.
8
Distributed High Rate TCP Indicates a distributed high rate TCP
DoS
DoS attack.
STRM Log Manager Administration Guide
8
DoS
137
Table C-3 DoS Categories (continued)
Low Level Event
Category
Description
Severity Level
(0 to 10)
Distributed High Rate UDP Indicates a distributed high rate UDP
DoS
DoS attack.
8
Distributed High Rate
ICMP DoS
8
Indicates a distributed high rate ICMP
DoS attack.
Distributed High Rate DoS Indicates a distributed high rate DoS
attack.
8
Distributed Medium Rate
TCP DoS
Indicates a distributed medium rate
TCP DoS attack.
8
Distributed Medium Rate
UDP DoS
Indicates a distributed medium rate
UDP DoS attack.
8
Distributed Medium Rate
ICMP DoS
Indicates a distributed medium rate
ICMP DoS attack.
8
Distributed Medium Rate
DoS
Indicates a distributed medium rate
DoS attack.
8
Distributed Low Rate TCP
DoS
Indicates a distributed low rate TCP
DoS attack.
8
Distributed Low Rate UDP Indicates a distributed low rate UDP
DoS
DoS attack.
8
Distributed Low Rate ICMP Indicates a distributed low rate ICMP
DoS
DoS attack.
8
Distributed Low Rate DoS
Indicates a distributed low rate DoS
attack.
8
High Rate TCP Scan
Indicates a high rate TCP scan.
8
High Rate UDP Scan
Indicates a high rate UDP scan.
8
High Rate ICMP Scan
Indicates a high rate ICMP scan.
8
High Rate Scan
Indicates a high rate scan.
8
Medium Rate TCP Scan
Indicates a medium rate TCP scan.
8
Medium Rate UDP Scan
Indicates a medium rate UDP scan.
8
Medium Rate ICMP Scan
Indicates a medium rate ICMP scan.
8
Medium Rate Scan
Indicates a medium rate scan.
8
Low Rate TCP Scan
Indicates a low rate TCP scan.
8
Low Rate UDP Scan
Indicates a low rate UDP scan.
8
Low Rate ICMP Scan
Indicates a low rate ICMP scan.
8
Low Rate Scan
Indicates a low rate scan.
8
VoIP DoS
Indicates a VoIP DoS attack.
8
Flood
Indicates a Flood attack.
8
TCP Flood
Indicates a TCP flood attack.
8
UDP Flood
Indicates a UDP flood attack.
8
STRM Log Manager Administration Guide
138
EVENT CATEGORIES
Table C-3 DoS Categories (continued)
Authentication
Low Level Event
Category
Description
Severity Level
(0 to 10)
ICMP Flood
Indicates a ICMP flood attack.
8
SYN Flood
Indicates a SYN flood attack.
8
URG Flood
Indicates a flood attack with the urgent 8
(URG) flag on.
SYN URG Flood
Indicates a SYN flood attack with the
urgent (URG) flag on.
8
SYN FIN Flood
Indicates a SYN FIN flood attack.
8
SYN ACK Flood
Indicates a SYN ACK flood attack.
8
The authentication category indicates events relating to authentication, sessions
and access controls to monitor users on the network. The associated low-level
event categories include:
Table C-4 Authentication Categories
Low Level Event
Category
Description
Severity Level
(0 to 10)
Unknown Authentication
Indicates unknown authentication.
1
Host Login Succeeded
Indicates a successful host login.
1
Host Login Failed
Indicates the host login has failed.
3
Misc Login Succeeded
Indicates that the login sequence
succeeded.
1
Misc Login Failed
Indicates that login sequence failed.
3
Privilege Escalation Failed Indicates that the privileged escalation
failed.
3
Privilege Escalation
Succeeded
Indicates that the privilege escalation
succeeded.
1
Mail Service Login
Succeeded
Indicates that the mail service login
succeeded.
1
Mail Service Login Failed
Indicates that the mail service login
failed.
3
Auth Server Login Failed
Indicates that the authentication server 3
login failed.
Auth Server Login
Succeeded
Indicates that the authentication server 1
login succeeded.
Web Service Login
Succeeded
Indicates that the web service login
succeeded.
1
Web Service Login Failed
Indicates that the web service login
failed.
3
STRM Log Manager Administration Guide
Authentication
139
Table C-4 Authentication Categories (continued)
Low Level Event
Category
Description
Severity Level
(0 to 10)
Admin Login Successful
Indicates an administrative login has
been successful.
1
Admin Login Failure
Indicates the administrative login failed. 3
Suspicious Username
Indicates that a user attempted to
access the network using an incorrect
username.
4
Login with username/
password defaults
successful
Indicates that a user accessed the
network using the default username
and password.
4
Login with username/
password defaults failed
Indicates that a user has been
unsuccessful accessing the network
using the default username and
password.
4
FTP Login Succeeded
Indicates that the FTP login has been
successful.
1
FTP Login Failed
Indicates that the FTP login failed.
3
SSH Login Succeeded
Indicates that the SSH login has been
successful.
1
SSH Login Failed
Indicates that the SSH login failed.
2
User Right Assigned
Indicates that user access to network
resources has been successfully
granted.
1
User Right Removed
Indicates that user access to network
resources has been successfully
removed.
1
Trusted Domain Added
Indicates that a trusted domain has
been successfully added to your
deployment.
1
Trusted Domain Removed Indicates that a trusted domain has
been removed from your deployment.
1
System Security Access
Granted
Indicates that system security access
has been successfully granted.
1
System Security Access
Removed
Indicates that system security access
has been successfully removed.
1
Policy Added
Indicates that a policy has been
successfully added.
1
Policy Change
Indicates that a policy has been
successfully changed.
1
User Account Added
Indicates that a user account has been 1
successfully added.
User Account Changed
Indicates a change to an existing user
account.
STRM Log Manager Administration Guide
1
140
EVENT CATEGORIES
Table C-4 Authentication Categories (continued)
Low Level Event
Category
Description
Severity Level
(0 to 10)
Password Change Failed
Indicates that an attempt to change an
existing password failed.
3
Password Change
Succeeded
Indicates that a password change has
been successful.
1
User Account Removed
Indicates that a user account has been 1
successfully removed.
Group Member Added
Indicates that a group member has
been successfully added.
1
Group Member Removed
Indicates that a group member has
been removed.
1
Group Added
Indicates that a group has been
successfully added.
1
Group Changed
Indicates a change to an existing
group.
1
Group Removed
Indicates a group has been removed.
1
Computer Account Added
Indicates a computer account has been 1
successfully added.
Computer Account
Changed
Indicates a change to an existing
computer account.
Computer Account
Removed
Indicates a computer account has been 1
successfully removed.
Remote Access Login
Succeeded
Indicates that access to the network
using a remote login has been
successful.
Remote Access Login
Failed
Indicates that an attempt to access the 3
network using a remote login failed.
General Authentication
Successful
Indicates that the authentication
processes has been successful.
1
General Authentication
Failed
Indicates that the authentication
process failed.
3
Telnet Login Succeeded
Indicates that the telnet login has been 1
successful.
Telnet Login Failed
Indicates that the telnet login failed.
Suspicious Password
Indicates that a user attempted to login 4
using a suspicious password.
Samba Login Successful
Indicates a user successfully logged in 1
using Samba.
Samba Login Failed
Indicates user login failed using
Samba.
STRM Log Manager Administration Guide
1
1
3
3
Authentication
141
Table C-4 Authentication Categories (continued)
Low Level Event
Category
Description
Severity Level
(0 to 10)
Auth Server Session
Opened
Indicates that a communication session 1
with the authentication server has been
started.
Auth Server Session
Closed
Indicates that a communication session 1
with the authentication server has been
closed.
Firewall Session Closed
Indicates that a firewall session has
been closed.
1
Host Logout
Indicates that a host successfully
logged out.
1
Misc Logout
Indicates that a user successfully
logged out.
1
Auth Server Logout
Indicates that the process to log out of
the authentication server has been
successful.
1
Web Service Logout
Indicates that the process to log out of
the web service has been successful.
1
Admin Logout
Indicates that the administrative user
successfully logged out.
1
FTP Logout
Indicates that the process to log out of
the FTP service has been successful.
1
SSH Logout
Indicates that the process to log out of
the SSH session has been successful.
1
Remote Access Logout
Indicates that the process to log out
using remote access has been
successful.
1
Telnet Logout
Indicates that the process to log out of
the Telnet session has been
successful.
1
Samba Logout
Indicates that the process to log out of
Samba has been successful.
1
SSH Session Started
Indicates that the SSH login session
has been initiated on a host.
1
SSH Session Finished
Indicates the termination of an SSH
login session on a host.
1
Admin Session Started
Indicates that a login session has been 1
initiated on a host by an administrative
or privileged user.
Admin Session Finished
Indicates the termination of an
administrator or privileged users login
session on a host.
1
VoIP Login Succeeded
Indicates a successful VoIP service
login
1
STRM Log Manager Administration Guide
142
EVENT CATEGORIES
Table C-4 Authentication Categories (continued)
Low Level Event
Category
Description
Severity Level
(0 to 10)
VoIP Login Failed
Indicates an unsuccessful attempt to
access VoIP service.
1
VoIP Logout
Indicates a user logout,
1
VoIP Session Initiated
Indicates the beginning of a VoIP
session.
1
VoIP Session Terminated
Indicates the end of a VoIP session.
1
Database Login
Succeeded
Indicates a successful database login.
1
Database Login Failure
Indicates a database login attempt
failed.
3
IKE Authentication Failed
Indicates a failed Internet Key
Exchange (IKE) authentication has
been detected.
3
IKE Authentication
Succeeded
Indicates a successful IKE
authentication has been detected.
1
IKE Session Started
Indicates an IKE session started.
1
IKE Session Ended
Indicates an IKE session ended.
1
IKE Error
Indicates an IKE error message.
1
IKE Status
Indicates IKE status message.
1
RADIUS Session Started
Indicates a RADIUS session started.
1
RADIUS Session Ended
Indicates a RADIUS session ended.
1
RADIUS Session Denied
Indicates a RADIUS session has been
denied.
1
RADIUS Session Status
Indicates a RADIUS session status
message.
1
RADIUS Authentication
Failed
Indicates a RADIUS authentication
failure.
3
RADIUS Authentication
Successful
Indicates a RADIUS authentication
succeeded.
1
TACACS Session Started
Indicates a TACACS session started.
1
TACACS Session Ended
Indicates a TACACS session ended.
1
TACACS Session Denied
Indicates a TACACS session has been 1
denied.
TACACS Session Status
Indicates a TACACS session status
message.
1
TACACS Authentication
Successful
Indicates a TACACS authentication
succeeded.
1
TACACS Authentication
Failed
Indicates a TACACS authentication
failure.
1
STRM Log Manager Administration Guide
Authentication
143
Table C-4 Authentication Categories (continued)
Low Level Event
Category
Description
Severity Level
(0 to 10)
Deauthenticating Host
Succeeded
Indicates that the deauthentication of a 1
host has been successful.
Deauthenticating Host
Failed
Indicates that the deauthentication of a 3
host failed.
Station Authentication
Succeeded
Indicates that the station authentication 1
has been successful.
Station Authentication
Failed
Indicates that the station authentication 3
of a host failed.
Station Association
Succeeded
Indicates that the station association
has been successful.
1
Station Association Failed
Indicates that the station association
failed.
3
Station Reassociation
Succeeded
Indicates that the station reassociation 1
has been successful.
Station Reassociation
Failed
Indicates that the station association
failed.
Disassociating Host
Succeeded
Indicates that the disassociating a host 1
has been successful.
3
Disassociating Host Failed Indicates that the disassociating a host 3
failed.
SA Error
Indicates a Security Association (SA)
error message.
5
SA Creation Failure
Indicates a Security Association (SA)
creation failure.
3
SA Established
Indicates that a Security Association
(SA) connection established.
1
SA Rejected
Indicates that a Security Association
(SA) connection rejected.
3
Deleting SA
Indicates the deletion of a Security
Association (SA).
1
Creating SA
Indicates the creation of a Security
Association (SA).
1
Certificate Mismatch
Indicates a certificate mismatch.
3
Credentials Mismatch
Indicates a credentials mismatch.
3
Admin Login Attempt
Indicates an admin login attempt.
2
User Login Attempt
Indicates a user login attempt.
2
User Login Successful
Indicates a successful user login.
1
User Login Failure
Indicates a failed user login.
3
STRM Log Manager Administration Guide
144
EVENT CATEGORIES
Access
The access category indicates authentication and access controls for monitoring
network events. The associated low-level event categories include:
Table C-5 Access Categories
Low Level Event
Category
Description
Unknown Network
Communication Event
Indicates an unknown network
communication event.
3
Firewall Permit
Indicates access to the firewall has
been permitted.
0
Firewall Deny
Indicates access to the firewall has
been denied.
4
Misc Network
Communication Event
Indicates a miscellaneous
communications event.
3
IPS Deny
Indicates Intrusion Prevention Systems 4
(IPS) denied traffic.
Firewall Session Opened
Indicates the firewall session has been 0
opened.
Firewall Session Closed
Indicates the firewall session has been 0
closed.
Dynamic Address
Translation Successful
Indicates that dynamic address
translation has been successful.
0
No Translation Group
Found
Indicates that no translation group has
been found.
2
Misc Authorization
Indicates that access has been granted 2
to a miscellaneous authentication
server.
ACL Permit
Indicates that an Access Control List
(ACL) permitted access.
0
ACL Deny
Indicates that an Access Control List
(ACL) denied access.
4
Access Permitted
Indicates that access has been
permitted.
0
Access Denied
Indicates that access has been denied. 4
Session Opened
Indicates that a session has been
opened
1
Session Closed
Indicates that a session has been
closed.
1
Session Reset
Indicates that a session has been
reset.
3
Session Terminated
Indicates that a session has been
terminated.
4
Session Denied
Indicates that a session has been
denied.
5
STRM Log Manager Administration Guide
Severity Level
(0 to 10)
Exploit
145
Table C-5 Access Categories (continued)
Low Level Event
Category
Exploit
Description
Severity Level
(0 to 10)
Session in Progress
Indicates that a session is currently in
progress.
1
Session Delayed
Indicates that a session has been
delayed.
3
Session Queued
Indicates that a session has been
queued.
1
Session Inbound
Indicates that a session is inbound.
1
Session Outbound
Indicates that a session is outbound.
1
Unauthorized Access
Attempt
Indicates that an unauthorized access
attempt has been detected
6
Misc Application Action
Allowed
Indicates that an application action has 1
been permitted
Misc Application Action
Denied
Indicates that an application action has 3
been denied
Database Action Allowed
Indicates that a database action has
been permitted.
1
Database Action Denied
Indicates that a database action has
been denied.
3
FTP Action Allowed
Indicates that a FTP action has been
permitted.
1
FTP Action Denied
Indicates that a FTP action has been
denied.
3
Object Cached
Indicates an object cached.
1
Object Not Cached
Indicates an object not cached.
1
Rate Limiting
Indicates that the network is rate
limiting traffic.
4
No Rate Limiting
Indicates that the network is not rate
limiting traffic.
0
The exploit category indicates events where a communication or access has
occurred. The associated low-level event categories include:
Table C-6 Exploit Categories
Low Level Event
Category
Description
Severity Level
(0 to 10)
Unknown Exploit Attack
Indicates an unknown exploit attack.
9
Buffer Overflow
Indicates a buffer overflow.
9
DNS Exploit
Indicates a DNS exploit.
9
Telnet Exploit
Indicates a Telnet exploit.
9
STRM Log Manager Administration Guide
146
EVENT CATEGORIES
Table C-6 Exploit Categories (continued)
Low Level Event
Category
Description
Severity Level
(0 to 10)
Linux Exploit
Indicates a Linux exploit.
9
Unix Exploit
Indicates a Unix exploit.
9
Windows Exploit
Indicates a Windows exploit.
9
Mail Exploit
Indicates a mail server exploit.
9
Infrastructure Exploit
Indicates an infrastructure exploit.
9
Misc Exploit
Indicates a miscellaneous exploit.
9
Web Exploit
Indicates a web exploit.
9
Session Hijack
Indicates a session in your network has 9
been interceded.
Worm Active
Indicates an active worm.
10
Password Guess/Retrieve
Indicates that a user has requested
access to their password information
from the database.
9
FTP Exploit
Indicates an FTP exploit.
9
RPC Exploit
Indicates an RPC exploit.
9
SNMP Exploit
Indicates an SNMP exploit.
9
NOOP Exploit
Indicates an NOOP exploit.
9
Samba Exploit
Indicates an Samba exploit.
9
Database Exploit
Indicates a database exploit.
9
SSH Exploit
Indicates an SSH exploit.
9
ICMP Exploit
Indicates an ICMP exploit.
9
UDP Exploit
Indicates a UDP exploit.
9
Browser Exploit
Indicates an exploit on your browser.
9
DHCP Exploit
Indicates a DHCP exploit
9
Remote Access Exploit
Indicates a remote access exploit
9
ActiveX Exploit
Indicates an exploit through an ActiveX 9
application.
SQL Injection
Indicates that an SQL injection has
occurred.
9
Cross-Site Scripting
Indicates a cross-site scripting
vulnerability.
9
Format String Vulnerability Indicates a format string vulnerability.
9
Input Validation Exploit
Indicates that an input validation exploit 9
attempt has been detected.
Remote Code Execution
Indicates that a remote code execution 9
attempt has been detected.
Memory Corruption
Indicates that a memory corruption
exploit has been detected.
STRM Log Manager Administration Guide
9
Malware
147
Table C-6 Exploit Categories (continued)
Low Level Event
Category
Command Execution
Malware
Description
Indicates that a remote command
execution attempt has been detected.
Severity Level
(0 to 10)
9
The malicious software (malware) category indicates events relating to application
exploits and buffer overflow attempts. The associated low-level event categories
include:
Table C-7 Malware Categories
Low Level Event
Category
Description
Severity Level
(0 to 10)
Unknown Malware
Indicates an unknown virus.
4
Backdoor Detected
Indicates that a backdoor to the system 9
has been detected.
Hostile Mail Attachment
Indicates a hostile mail attachment.
6
Malicious Software
Indicates a virus.
6
Hostile Software Download Indicates a hostile software download
to your network.
6
Virus Detected
Indicates a virus has been detected.
8
Misc Malware
Indicates miscellaneous malicious
software
4
Trojan Detected
Indicates a trojan has been detected.
7
Spyware Detected
Indicates spyware has been detected
on your system.
6
Content Scan
Indicates that an attempted scan of
your content has been detected.
3
Content Scan Failed
Indicates that a scan of your content
has failed.
8
Content Scan Successful
Indicates that a scan of your content
has been successful.
3
Content Scan in Progress
Indicates that a scan of your content is 3
currently in progress.
Keylogger
Indicates that a key logger has been
detected.
7
Adware Detected
Indicates that Ad-Ware has been
detected.
4
STRM Log Manager Administration Guide
148
EVENT CATEGORIES
Suspicious Activity
The suspicious activity category indicates events relating to viruses, trojans, back
door attacks, and other forms of hostile software. The associated low-level event
categories include:
Table C-8 Suspicious Categories
Low Level Event
Category
Description
Severity Level
(0 to 10)
Unknown Suspicious
Event
Indicates an unknown suspicious
event.
3
Suspicious Pattern
Detected
Indicates a suspicious pattern has
been detected.
3
Content Modified By
Firewall
Indicates that content has been
modified by the firewall.
3
Invalid Command or Data
Indicates an invalid command or data.
3
Suspicious Packet
Indicates a suspicious packet.
3
Suspicious Activity
Indicates suspicious activity.
3
Suspicious File Name
Indicates a suspicious file name.
3
Suspicious Port Activity
Indicates suspicious port activity.
3
Suspicious Routing
Indicates suspicious routing.
3
Potential Web Vulnerability Indicates potential web vulnerability.
3
Unknown Evasion Event
Indicates an unknown evasion event.
5
IP Spoof
Indicates an IP spoof.
5
IP Fragmentation
Indicates IP fragmentation.
3
Overlapping IP Fragments Indicates overlapping IP fragments.
5
IDS Evasion
Indicates an IDS evasion.
5
DNS Protocol Anomaly
Indicates a DNS protocol anomaly.
3
FTP Protocol Anomaly
Indicates an FTP protocol anomaly.
3
Mail Protocol Anomaly
Indicates a mail protocol anomaly.
3
Routing Protocol Anomaly
Indicates a routing protocol anomaly.
3
Web Protocol Anomaly
Indicates a web protocol anomaly.
3
SQL Protocol Anomaly
Indicates an SQL protocol anomaly.
3
Executable Code Detected Indicates that an executable code has
been detected.
5
Misc Suspicious Event
Indicates a miscellaneous suspicious
event.
3
Information Leak
Indicates an information leak.
1
Potential Mail Vulnerability Indicates a potential vulnerability in the 4
mail server.
Potential Version
Vulnerability
Indicates a potential vulnerability in the 4
STRM Log Manager version.
STRM Log Manager Administration Guide
Suspicious Activity
149
Table C-8 Suspicious Categories (continued)
Low Level Event
Category
Description
Potential FTP Vulnerability Indicates a potential FTP vulnerability.
Severity Level
(0 to 10)
4
Potential SSH Vulnerability Indicates a potential SSH vulnerability. 4
Potential DNS Vulnerability Indicates a potential vulnerability in the 4
DNS server.
Potential SMB Vulnerability Indicates a potential SMB (Samba)
vulnerability.
4
Potential Database
Vulnerability
Indicates a potential vulnerability in the 4
database.
IP Protocol Anomaly
Indicates a potential IP protocol
anomaly
3
Suspicious IP Address
Indicates a suspicious IP address has
been detected.
2
Invalid IP Protocol Usage
Indicates an invalid IP protocol misuse. 2
Invalid Protocol
Indicates an invalid protocol.
4
Suspicious Window Events Indicates a suspicious event with a
screen on your desktop.
2
Suspicious ICMP Activity
2
Indicates suspicious ICMP activity.
Potential NFS Vulnerability Indicates a potential Network File
System (NFS) vulnerability.
Potential NNTP
Vulnerability
4
Indicates a potential Network News
4
Transfer Protocol (NNTP) vulnerability.
Potential RPC Vulnerability Indicates a potential RPC vulnerability. 4
Potential Telnet
Vulnerability
Indicates a potential Telnet vulnerability 4
on your system.
Potential SNMP
Vulnerability
Indicates a potential SNMP
vulnerability.
4
Illegal TCP Flag
Combination
Indicates an invalid TCP flag
combination has been detected.
5
Suspicious TCP Flag
Combination
Indicates a potentially invalid TCP flag
combination has been detected.
4
Illegal ICMP Protocol
Usage
Indicates an invalid use of the ICMP
protocol has been detected.
5
Suspicious ICMP Protocol
Usage
Indicates a potentially invalid use of the 4
ICMP protocol has been detected.
Illegal ICMP Type
Indicates an invalid ICMP type has
been detected.
5
Illegal ICMP Code
Indicates an invalid ICMP code has
been detected.
5
Suspicious ICMP Type
Indicates a potentially invalid ICMP
type has been detected.
4
STRM Log Manager Administration Guide
150
EVENT CATEGORIES
Table C-8 Suspicious Categories (continued)
Low Level Event
Category
Description
Severity Level
(0 to 10)
Suspicious ICMP Code
Indicates a potentially invalid ICMP
code has been detected.
4
TCP port 0
Indicates a TCP packet using a
reserved port (0) for source or
destination.
4
UDP port 0
Indicates a UDP packets using a
reserved port (0) for source or
destination.
4
Hostile IP
Indicates the use of a known hostile IP 4
address.
Watch list IP
Indicates the use of an IP address from 4
a watch list of IP addresses.
Known offender IP
Indicates the use of an IP address of a 4
known offender.
RFC 1918 (private) IP
Indicates the use of an IP address from 4
a private IP address range.
Potential VoIP Vulnerability Indicates a potential VoIP vulnerability. 4
Blacklist Address
Indicates that an IP address is on the
black list.
8
Watchlist Address
Indicates that the IP address is on the
list of IP addresses being monitored.
7
Darknet Address
Indicates that the IP address is part of a 5
darknet.
Botnet Address
Indicates that the address is part of a
botnet.
Suspicious Address
Indicates that the IP address should be 5
monitored.
Bad Content
Indicates bad content has been
detected.
Invalid Cert
Indicates an invalid certificate has been 7
detected.
User Activity
Indicates that user activity has been
detected.
7
Suspicious Protocol Usage Indicates suspicious protocol usage
has been detected.
5
Suspicious BGP Activity
Indicates that suspicious Border
Gateway Protocol (BGP) usage has
been detected.
5
Route Poisoning
Indicates that route corruption has
been detected.
5
ARP Poisoning
Indicates that ARP-cache poisoning
has been detected.
5
STRM Log Manager Administration Guide
7
7
System
151
Table C-8 Suspicious Categories (continued)
Low Level Event
Category
Rogue Device Detected
System
Description
Indicates a rogue device has been
detected.
Severity Level
(0 to 10)
5
The system category indicates events relating to system changes, software
installation, or status messages. The associated low-level event categories
include:
Table C-9 System Categories
Low Level Event
Category
Description
Severity Level
(0 to 10)
Unknown System Event
Indicates an unknown system event.
1
System Boot
Indicates a system boot.
1
System Configuration
Indicates a change in the system
configuration.
1
System Halt
Indicates the system has been halted.
1
System Failure
Indicates a system failure.
6
System Status
Indicates any information event.
1
System Error
Indicates a system error.
3
Misc System Event
Indicates a miscellaneous system
event.
1
Service Started
Indicates system services have started. 1
Service Stopped
Indicates system services have
stopped.
1
Service Failure
Indicates a system failure.
6
Successful Registry
Modification
Indicates that a modification to the
registry has been successful.
1
Successful Host-Policy
Modification
Indicates that a modification to the host 1
policy has been successful.
Successful File
Modification
Indicates that a modification to a file
has been successful.
1
Successful Stack
Modification
Indicates that a modification to the
stack has been successful.
1
Successful Application
Modification
Indicates that a modification to the
application has been successful.
1
Successful Configuration
Modification
Indicates that a modification to the
configuration has been successful.
1
Successful Service
Modification
Indicates that a modification to a
service has been successful.
1
STRM Log Manager Administration Guide
152
EVENT CATEGORIES
Table C-9 System Categories (continued)
Low Level Event
Category
Description
Failed Registry
Modification
Indicates that a modification to the
registry has failed.
Failed Host-Policy
Modification
Indicates that a modification to the host 1
policy has failed.
Failed File Modification
Indicates that a modification to a file
has failed.
1
Failed Stack Modification
Indicates that a modification to the
stack has failed.
1
Failed Application
Modification
Indicates that a modification to an
application has failed.
1
Failed Configuration
Modification
Indicates that a modification to the
configuration has failed.
1
Failed Service Modification Indicates that a modification to the
service has failed.
1
Registry Addition
Indicates that an new item has been
added to the registry.
1
Host-Policy Created
Indicates that a new entry has been
added to the registry.
1
File Created
Indicates that a new has been created
in the system.
1
Application Installed
Indicates that a new application has
been installed on the system.
1
Service Installed
Indicates that a new service has been
installed on the system.
1
Registry Deletion
Indicates that a registry entry has been 1
deleted.
Host-Policy Deleted
Indicates that a host policy entry has
been deleted.
1
File Deleted
Indicates that a file has been deleted.
1
Application Uninstalled
Indicates that an application has been
uninstalled.
1
Service Uninstalled
Indicates that a service has been
uninstalled.
1
System Informational
Indicates system information.
3
System Action Allow
Indicates that an attempted action on
the system has been authorized.
3
System Action Deny
Indicates that an attempted action on
the system has been denied.
4
Cron
Indicates a crontab message.
1
Cron Status
Indicates a crontab status message.
1
Cron Failed
Indicates a crontab failure message.
4
STRM Log Manager Administration Guide
Severity Level
(0 to 10)
1
System
153
Table C-9 System Categories (continued)
Low Level Event
Category
Description
Severity Level
(0 to 10)
Cron Successful
Indicates a crontab success message.
1
Daemon
Indicates a daemon message.
1
Daemon Status
Indicates a daemon status message.
1
Daemon Failed
Indicates a daemon failure message.
4
Daemon Successful
Indicates a daemon success message. 1
Kernel
Indicates a kernel message.
1
Kernel Status
Indicates a kernel status message.
1
Kernel Failed
Indicates a kernel failure message.
Kernel Successful
Indicates a kernel successful message. 1
Authentication
Indicates an authentication message.
1
Information
Indicates an informational message.
2
Notice
Indicates a notice message.
3
Warning
Indicates a warning message.
5
Error
Indicates an error message.
7
Critical
Indicates a critical message.
9
Debug
Indicates a debug message.
1
Messages
Indicates a generic message.
1
Privilege Access
Indicates that privilege access has
been attempted.
3
Alert
Indicates an alert message.
9
Emergency
Indicates an emergency message.
9
SNMP Status
Indicates an SNMP status message.
1
FTP Status
Indicates an FTP status message.
1
NTP Status
Indicates an NTP status message.
1
Access Point Radio Failure Indicates an access point radio failure.
3
Encryption Protocol
Configuration Mismatch
Indicates an encryption protocol
configuration mismatch.
3
Client Device or
Authentication Server
Misconfigured
Indicates a client device or
authentication server has been not
configured properly.
5
Hot Standby Enable Failed Indicates a hot standby enable failure.
5
Hot Standby Disable
Failed
Indicates a hot standby disable failure.
5
Hot Standby Enabled
Successfully
Indicates hot standby has been
enabled successfully.
1
Hot Standby Association
Lost
Indicates a hot standby association has 5
been lost.
STRM Log Manager Administration Guide
154
EVENT CATEGORIES
Table C-9 System Categories (continued)
Low Level Event
Category
Policy
Description
Severity Level
(0 to 10)
MainMode Initiation Failure Indicates MainMode initiation failure.
5
MainMode Initiation
Succeeded
Indicates that the MainMode initiation
has been successful.
1
MainMode Status
Indicates a MainMode status message 1
has been reported.
QuickMode Initiation
Failure
Indicates that the QuickMode initiation
failed.
5
Quickmode Initiation
Succeeded
Indicates that the QuickMode initiation
has been successful.
1
Quickmode Status
Indicates a QuickMode status message 1
has been reported.
Invalid License
Indicates an invalid license.
3
License Expired
Indicates an expired license.
3
New License Applied
Indicates a new license applied.
1
License Error
Indicates a license error.
5
License Status
Indicates a license status message.
1
Configuration Error
Indicates that a configuration error has 5
been detected.
Service Disruption
Indicates that a service disruption has
been detected.
5
License Exceeded
Indicates that the license capabilities
have been exceeded.
3
Performance Status
Indicates that the performance status
has been reported.
1
Performance Degradation
Indicates that the performance is being 4
degraded.
Misconfiguration
Indicates that a incorrect configuration
has been detected.
5
The policy category indicates events relating to administration of network policy
and the monitoring network resources for policy violations. The associated
low-level event categories include:
Table C-10 Policy Categories
Low Level Event
Category
Description
Severity Level
(0 to 10)
Unknown Policy Violation
Indicates an unknown policy violation.
2
Web Policy Violation
Indicates a web policy violation.
2
STRM Log Manager Administration Guide
CRE
155
Table C-10 Policy Categories (continued)
Low Level Event
Category
Description
Severity Level
(0 to 10)
Remote Access Policy
Violation
Indicates a remote access policy
violation.
2
IRC/IM Policy Violation
Indicates an instant messenger policy
violation.
2
P2P Policy Violation
Indicates a Peer-to-Peer (P2P) policy
violation.
2
IP Access Policy Violation
Indicates an IP access policy violation. 2
Application Policy Violation Indicates an application policy violation. 2
CRE
Database Policy Violation
Indicates a database policy violation.
2
Network Threshold Policy
Violation
Indicates a network threshold policy
violation.
2
Porn Policy Violation
Indicates a porn policy violation.
2
Games Policy Violation
Indicates a games policy violation.
2
Misc Policy Violation
Indicates a miscellaneous policy
violation.
2
Compliance Policy
Violation
Indicates a compliance policy violation. 2
Mail Policy Violation
Indicates a mail policy violation.
2
IRC Policy Violation
Indicates an IRC policy violation
2
IM Policy Violation
Indicates a policy violation related to
instant messaging (IM) activities.
2
VoIP Policy Violation
Indicates a VoIP policy violation
2
Succeeded
Indicates a policy successful message. 1
Failed
Indicates a policy failure message.
4
The CRE category indicates events generated from an event rule. The associated
low-level event categories include:
Table C-11 CRE Category
Low Level Event
Category
Description
Severity Level
(0 to 10)
Unknown CRE Event
Indicates an unknown custom rules
engine event.
5
Single Event Rule Match
Indicates a single event rule match.
5
Event Sequence Rule
Match
Indicates an event sequence rule
match.
5
STRM Log Manager Administration Guide
156
EVENT CATEGORIES
Potential Exploit
The Potential Exploit category indicates events relating to potential application
exploits and buffer overflow attempts. The associated low-level event categories
include:
Table C-12 Potential Exploit Category
Low Level Event
Category
Description
Unknown Potential Exploit
Attack
Indicates a potential exploitative attack 7
has been detected.
Potential Buffer Overflow
Indicates a potential buffer overflow
has been detected.
7
Potential DNS Exploit
Indicates a potentially exploitative
attack through the DNS server has
been detected.
7
Potential Telnet Exploit
Indicates a potentially exploitative
attack through Telnet has been
detected.
7
Potential Linux Exploit
Indicates a potentially exploitative
attack through Linux has been
detected.
7
Potential Unix Exploit
Indicates a potentially exploitative
7
attack through Unix has been detected.
Potential Windows Exploit
Indicates a potentially exploitative
attack through Windows has been
detected.
Potential Mail Exploit
Indicates a potentially exploitative
7
attack through mail has been detected.
Potential Infrastructure
Exploit
Indicates a potential exploitative attack 7
on the system infrastructure has been
detected.
Potential Misc Exploit
Indicates a potentially exploitative
attack has been detected.
7
Potential Web Exploit
Indicates a potentially exploitative
attack through the web has been
detected.
7
Potential Botnet
connection
Indicates a potentially exploitative
6
attack using Botnet has been detected.
Potential worm activity
Indicates a potentially exploitive attack 6
using worm activity has been detected.
STRM Log Manager Administration Guide
Severity Level
(0 to 10)
7
SIM Audit
SIM Audit
157
The SIM Audit events category indicates events related to user interaction with the
Console and administrative functionality . User login and configuration changes will
generate events that are sent to the Event Collector, which correlates with other
security events from the network. The associated low-level event categories
include:
Table C-13 SIM Audit Event Category
Low Level Event
Category
SIM User Authentication
Audit
Description
Indicates a user login or logout on the
Console.
Severity Level
(0 to 10)
5
SIM Configuration Change Indicates that a user has made a
change to the SIM configuration or
deployment.
3
SIM User Action
Indicates that a user has initiated a
process in the SIM module. This may
include starting a backup process or
generated a report.
3
Session Created
Indicates a user session has been
created.
3
Session Destroyed
Indicates a user session has been
destroyed.
3
Admin Session Created
Indicates an admin session has been
created.
Admin Session Destroyed
Indicates an admin session has been
destroyed.
3
Session Authentication
Invalid
Indicates an invalid session
authentication.
5
Session Authentication
Expired
Indicates a session authentication
expired.
3
The Audit category indicates audit related events. The associated low-level event
categories include:
Table C-14 Audit Categories
Low Level Event
Category
Description
Severity Level
(0 to 10)
General Audit Event
Indicates a general audit event has
been started.
1
Built-in Execution
Indicates that a built-in audit task has
been executed.
1
Bulk Copy
Indicates that a bulk copy of data has
been detected.
1
STRM Log Manager Administration Guide
158
EVENT CATEGORIES
Table C-14 Audit Categories (continued)
Low Level Event
Category
Description
Severity Level
(0 to 10)
Data Dump
Indicates that a data dump has been
detected.
1
Data Import
Indicates that a data import has been
detected.
1
Data Selection
Indicates that a data selection process
has been detected.
1
Data Truncation
Indicates that the data truncation
process has been detected.
1
Data Update
Indicates that the data update process
has been detected.
1
Procedure/Trigger
Execution
Indicates that the database procedure 1
or trigger execution has been detected.
Schema Change
Indicates that the schema for a
procedure or trigger execution has
been altered.
STRM Log Manager Administration Guide
1
INDEX
A
access category 144
accumulator
about 88
accumulator retention
daily 58
hourly 58
minute-by-minute 58
active directory 14
Admin tab
about 3
using 4
administrative email address 56
administrator role 9
aeriel database settings 58
alert email from address 56
Ariel database 110
audience 1
audit log
viewing 130
authentication
active directory 14
configuring 15
LDAP 14
RADIUS 14
system 14
TACACS 14
user 14
authentication category 138
auto detection 109
automatic update
on demand 55
scheduling 52
B
backup and recovery 77
C
changes
deploying 4
coalescing events 57
command line max matched results 58
components 108
configuring SSL for LDAP 17
console
settings 72
conventions 1
CRE category 155
customer support
contacting 2
D
database settings 57
delete root mail 56
deploying changes 4
deployment editor
accessing 88
creating your deployment 90
event view 91
preferences 91
requirements 91
system view 96
toolbar 89
using 88
device access 22
device management 24
DoS category 136
E
encryption 94, 96
event category
access category 144
audit events category 157
authentication category 138
CRE category 155
DoS category 136
exploit category 145
high-level categories 134
malware category 147
policy category 154
potential exploit category 156
recon category 134
sim audit category 157
suspicious category 148
system category 151
Event Collector
about 91
configuring 108
Event Processor
about 91
configuring 109
event retention buckets
about 64
configuring 65
deleting 70
editing 69
enabling and disabling 69
managing 68
sequencing 68
event view
about 88
adding components 92
building 91
STRM Log Manager Administration Guide
160
INDEX
connecting components 92
events role 9
exploit category 145
F
removing 102
using with STRM Log Manager 101
Net-SNMP 5
Network Address Translation. See NAT
network hierarchy
creating 47
firewall access 22
O
G
global IPtables access 57
glossary 133
off-site source 95
off-site target 95
P
H
hashing
algorithm 60
event log 59
high availability
about 31
adding 37
editing 42
restoring a failed host 45
setting HA host offline 44
setting HA host online 45
high-level categories 134
host
adding 98
host context 88, 105
I
IF-MAP 62
interface roles 24
IP right click menu extension role 9
L
LDAP 14
license key
exporting 21
managing 19
M
malware category 147
managed host
adding 98
assigning components 104
editing 99
removing 100
set-up 23
MIB 115
N
NAT
editing 102
enabling 100
partition tester time-out 57
passwords
changing 25
policy category 154
potential exploit category 156, 157
preferences 5
R
RADIUS authentication 14
RDATE 26
recon category 134
recovery 77
reporting max matched results 58
role 7
Admin 9
creating 8
editing 10
events 9
IP right click menu extension 9
managing 7
reporting 9
S
search results retention period 58
SNMP agent
accessing 21
SNMP settings 61
source
off-site 95
storage location
log source 58
store event payload 57
STRM Log Manager components 108
STRM Log Manager user 11
suspicious category 148
syslog
forwarding 113
adding 113
deleting 114
editing 114
system authentication 14
system category 151
system settings 56
configuring 56, 73
STRM Log Manager Administration Guide
INDEX
daily accumulator retention 58
event log hashing 59
hourly accumulator retention 58
IF-MAP 62
minute-by-minute accumulator retention 58
partition tester time-out 57
system thresholds 70
system time 26
system view
about 88
adding a host 98
assigning components 104
Host Context 105
managed host 103
managing 96
T
TACACS authentication 14
target
off-site 95
temporary files retention period 56
thresholds 70
time 26
time limit
command like execution 59
reporting execution 59
web execution 58
transaction sentry 60
U
updating user details 5
user
creating account 12
editing account 13
managing 7
roles 7
user data files 57
users
authentication 14
STRM Log Manager Administration Guide
161
">