Juniper Secure Analytics

Transcription

1 Juniper Secure Analytics Users Guide Release Modified:

2 Juniper Networks, Inc Innovation Way Sunnyvale, California USA All rights reserved. Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. Juniper Secure Analytics Users Guide All rights reserved. The information in this document is current as of the date on the title page. YEAR 2000 NOTICE Juniper Networks hardware and software products are Year 2000 compliant. Junos OS has no known time-related limitations through the year However, the NTP application is known to have some difficulty in the year END USER LICENSE AGREEMENT The Juniper Networks product that is the subject of this technical documentation consists of (or is intended for use with) Juniper Networks software. Use of such software is subject to the terms and conditions of the End User License Agreement ( EULA ) posted at By downloading, installing or using such software, you agree to the terms and conditions of that EULA. ii

3 Table of Contents About the Documentation xiii Documentation and Release Notes xiii Documentation Conventions xiii Documentation Feedback xv Requesting Technical Support xvi Self-Help Online Tools and Resources xvi Opening a Case with JTAC xvi Part 1 Juniper Secure Analytics Users Guide Chapter 1 Understanding Juniper Secure Analytics JSA Overview Supported Web Browsers Enabling Document Mode and Browser Mode in Internet Explorer Accessing JSA Understanding User Interface Tabs Understanding JSA Common Procedures Viewing Messages Sorting Results Refreshing and Pausing the User Interface Investigate User Names System Time Updating user details Access Online Help Resize Columns Configure Page Size Chapter 2 Managing Dashboard Understanding Dashboard Management Default Dashboards Custom Dashboards Customizing the Dashboard Flow Search Offenses Log Activity Most Recent Reports System Summary System Notification Creating a Custom Dashboard Using the Dashboard to Investigate Log or Network Activity Configuring Charts iii

4 Juniper Secure Analytics Users Guide Removing Dashboard Items Detaching a Dashboard Item Renaming a Dashboard Deleting a Dashboard Managing System Notifications Adding Search-based Dashboard Items to the Add Items List Chapter 3 Offense Management Offense Overview Offense Permission Considerations Key Terms Offense Retention Offense Monitoring Monitoring the All Offenses or My Offenses Pages Monitoring Offenses Grouped by Category Monitoring Offenses Grouped by Source IP Monitoring Offenses Grouped by Destination IP Monitoring Offenses Grouped by Network Offense Management Tasks Adding notes Hiding Offenses Showing Hidden Offenses Closing Offenses Protecting Offenses Unprotecting Offenses Exporting Offenses Assigning Offenses to Users Sending Notification Marking an Item for Follow-Up Offense Parameters Chapter 4 Log Activity Investigation Log Activity Tab Overview Log Activity Tab Toolbar Quick Filter Syntax Right-click Menu Options Status Bar Log Activity Monitoring Viewing Streaming Events Viewing Normalized Events Viewing Raw Events Viewing Grouped Events Event Details Event Details Toolbar Viewing Associated Offenses Modifying Event Mapping iv

5 Table of Contents Tuning False Positives Managing PCAP Data Displaying the PCAP Data Column Viewing PCAP Information Downloading the PCAP File to Your Desktop System Exporting Events Chapter 5 Network Activity Investigation Network Tab Overview Network Activity Tab Toolbar Quick Filter Syntax Right-click Menu Options Status Bar OverFlow Records Network Activity Monitoring Viewing Streaming Flows Viewing Normalized Flows Viewing Grouped Flows Flow Details Flow Details Toolbar Tuning False Positives Exporting Flows Chapter 6 Chart Management Chart Management Overview Time Series Chart Overview Chart Legends Configuring Charts Chapter 7 Data Searches Event and Flow Searches Searching for Items that Match your Criteria Saving Search Criteria Offense Searches Searching Offenses on the My Offenses and All Offenses Pages Searching Offenses on the By Source IP Page Searching Offenses on the By Destination IP Page Searching Offenses on the By Networks Page Saving Search Criteria on the Offenses Tab Deleting Search Criteria Using a Subsearch to Refine Search Results Managing Search Results Saving Search Results Viewing Managed Search Results Canceling a Search Deleting a Search Managing Search Groups Viewing Search Groups Creating a New Search Group Editing a Search Group v

6 Juniper Secure Analytics Users Guide Copying a Saved Search to Another Group Removing a Group or a Saved Search from a Group Chapter 8 Custom Event and Flow Properties Understanding Custom Event and Flow Properties Required Permissions Custom Property Types Creating a Regex-based Custom Property Creating a Calculation-based Custom Property Modifying a Custom Property Copying a Custom Property Deleting a Custom Property Chapter 9 Managing Rule Rule Permission Considerations Rules Overview Rule Categories Rule Types Rule Conditions Rule Responses Viewing Rules Creating a Custom Rule Rule Management Tasks Enabling and Disabling Rules Editing a Rule Copying a Rule Deleting a Rule Managing Rule Group Viewing a Rule Group Creating a Group Assigning an Item to a Group Editing a Group Copying an Item to Another Group Deleting an Item from a Group Deleting a Group Editing Building Blocks Understanding Rule Page Parameters Rules Page Toolbar Rule Response Page Parameters Chapter 10 Assets Profile Page Parameters Assets Profile Page Parameters Overview Understanding Asset Profiles Understanding Vulnerabilities Assets Tab Overview Asset Tab List Right-click Menu Options Viewing an Asset Profile Adding or Editing an Asset Profile Searching Asset Profiles vi

7 Table of Contents Saving Asset Search Criteria Asset Search Groups Viewing Search Groups Creating a New Search Group Editing a Search Group Copying a Saved Search to Another Group Removing a Group or a Saved Search From a Group Managing Asset Profile Deleting Assets Importing Asset Profiles Exporting Assets Researching Asset Vulnerabilities Assets Profile Page Parameters Asset Summary Pane Network Interface Summary Pane Vulnerability Pane Services Pane Windows Services Pane Packages Pane Windows Patches Pane Properties Pane Risk Policies Pane Products Pane Chapter 11 Managing Report Report Management Overview Status Bar Report Layout Chart Types Report Tab Toolbar Graph Types Creating Custom Reports Editing a Report Viewing Generated Reports Deleting Generated Content Manually Generating a Report Duplicating a Report Sharing a Report Branding Reports Managing Report Groups Creating a Report Group Editing a Group Assign a Report to a Group Copying a Report to Another Group Removing a Report Understanding Chart Container Asset Vulnerabilities Chart Container Parameters Event/Logs Chart Container Parameters Flows Chart Container Parameters vii

8 Juniper Secure Analytics Users Guide Top Source IPs Chart Container Parameters Top Offenses Chart Container Parameters Top Destination IPs Chart Container Parameters Glossary Part 2 Index Index viii

9 List of Tables About the Documentation xiii Table 1: Notice Icons xiv Table 2: Text and Syntax Conventions xiv Part 1 Juniper Secure Analytics Users Guide Chapter 1 Understanding Juniper Secure Analytics Table 3: Supported Web Browsers For JSA Products Table 4: Default Login Information for JSA Table 5: Administration Management Tools Available in JSA Table 6: Functions Available in the Messages Window Table 7: Menu Options for User Name Investigation Chapter 2 Managing Dashboard Table 8: Default Dashboards Table 9: Offense Items Table 10: Log Activity Dashboard Item Table 11: Chart Types Table 12: Configuring Charts Chapter 3 Offense Management Table 13: Offense Tab Key Terms Table 14: Pages that can be Accessed from the Offenses tab Table 15: of Offenses Tab Parameters Chapter 4 Log Activity Investigation Table 16: Log Activity Toolbar Options Table 17: Right-click Menu Options Table 18: Log Activity Tab - Default (Normalized) Parameters Table 19: Raw Event Parameters Table 20: Grouped Events Options Table 21: Grouped Event Parameters Table 22: Events Details Table 23: Event Details Toolbar Chapter 5 Network Activity Investigation Table 24: Network Activity Tab Toolbar Options Table 25: Right-click Menu Options Table 26: Parameters for the Network Activity Tab Table 27: Grouped Flow Options Table 28: Grouped Flow Parameters Table 29: Flow Details ix

10 Juniper Secure Analytics Users Guide Table 30: of the Flow Details Toolbar Chapter 6 Chart Management Table 31: Time Series Charts Functions Chapter 7 Data Searches Table 32: Search Options Table 33: My Offenses and All Offenses Page Search Pptions Table 34: Offense Type Options Table 35: By Source IP Page Search Options Table 36: By Destination IP Page Search Options Table 37: Search Options for Search Offense Data on the By Networks Page Table 38: Manage Search Results Page Parameters Table 39: Manage Search Results Toolbar Table 40: Search Group Window Parameters Table 41: Search Group Window Toolbar Functions Chapter 8 Custom Event and Flow Properties Table 42: Custom Property Definition Window Parameters (regex) Table 43: Custom Property Definition Window Parameters (calculation) Table 44: Custom Properties Window Columns Table 45: Custom Property Toolbar Options Chapter 9 Managing Rule Table 46: Rules Page Parameters Table 47: Rules Page Toolbar Function Table 48: Event, Flow, and Common Rule Response Page Parameters Table 49: Offense Rule Response Page Parameters Chapter 10 Assets Profile Page Parameters Table 50: Asset Profile Page Parameters Table 51: Right-click Menu Options Table 52: Viewing an Asset Profile Table 53: Asset Profile Table 54: Asset Profile Table 55: Owner Pane Parameter Options Table 56: Saving Asset Search Criteria Table 57: Asset Search Groups Window Toolbar Functions Table 58: Research Asset Vulnerabilities Table 59: Asset Summary Pane Parameters Table 60: Network Interface Summary Pane Parameters Table 61: Vulnerability Pane Parameters Table 62: Services Pane Parameters Table 63: Windows Services Pane Parameters Table 64: Packages Pane Parameters Table 65: Windows Patch Pane Table 66: Properties Pane Parameters Table 67: Risk Policies Pane Parameters Table 68: Products Pane Parameters Chapter 11 Managing Report x

11 List of Tables Table 69: Report Tab Toolbar Options Table 70: Graph Types Table 71: Asset Vulnerabilities Chart Container Parameters Table 72: Event/Logs Chart Container Parameters Table 73: Flows chart container details Table 74: Top Source IPs Chart Container Parameters Table 75: Top Offenses chart Container Parameters Table 76: Top Destination IPs Chart Container Parameters xi

12 Juniper Secure Analytics Users Guide xii

13 About the Documentation Documentation and Release Notes Documentation and Release Notes on page xiii Documentation Conventions on page xiii Documentation Feedback on page xv Requesting Technical Support on page xvi Documentation Conventions To obtain the most current version of all Juniper Networks technical documentation, see the product documentation page on the Juniper Networks website at If the information in the latest release notes differs from the information in the documentation, follow the product Release Notes. Juniper Networks Books publishes books by Juniper Networks engineers and subject matter experts. These books go beyond the technical documentation to explore the nuances of network architecture, deployment, and administration. The current list can be viewed at Table 1 on page xiv defines notice icons used in this guide. xiii

14 Juniper Secure Analytics Users Guide Table 1: Notice Icons Icon Meaning Informational note Indicates important features or instructions. Caution Indicates a situation that might result in loss of data or hardware damage. Warning Alerts you to the risk of personal injury or death. Laser warning Alerts you to the risk of personal injury from a laser. Tip Indicates helpful information. Best practice Alerts you to a recommended use or implementation. Table 2: Text and Syntax Conventions Table 2 on page xiv defines the text and syntax conventions used in this guide. Convention Examples Bold text like this Represents text that you type. To enter configuration mode, type the configure command: user@host> configure Fixed-width text like this Italic text like this Represents output that appears on the terminal screen. Introduces or emphasizes important new terms. Identifies guide names. Identifies RFC and Internet draft titles. user@host> show chassis alarms No alarms currently active A policy term is a named structure that defines match conditions and actions. Junos OS CLI User Guide RFC 1997, BGP Communities Attribute Italic text like this Represents variables (options for which you substitute a value) in commands or configuration statements. Configure the machine s domain name: [edit] root@# set system domain-name domain-name xiv

15 About the Documentation Table 2: Text and Syntax Conventions (continued) Convention Examples Text like this Represents names of configuration statements, commands, files, and directories; configuration hierarchy levels; or labels on routing platform components. To configure a stub area, include the stub statement at the [edit protocols ospf area area-id] hierarchy level. The console port is labeled CONSOLE. < > (angle brackets) Encloses optional keywords or variables. stub <default-metric metric>; (pipe symbol) Indicates a choice between the mutually exclusive keywords or variables on either side of the symbol. The set of choices is often enclosed in parentheses for clarity. broadcast multicast (string1 string2 string3) # (pound sign) Indicates a comment specified on the same line as the configuration statement to which it applies. rsvp { # Required for dynamic MPLS only [ ] (square brackets) Encloses a variable for which you can substitute one or more values. community name members [ community-ids ] Indention and braces ( { } ) ; (semicolon) Identifies a level in the configuration hierarchy. Identifies a leaf statement at a configuration hierarchy level. [edit] routing-options { static { route default { nexthop address; retain; } } } GUI Conventions Bold text like this Represents graphical user interface (GUI) items you click or select. In the Logical Interfaces box, select All Interfaces. To cancel the configuration, click Cancel. > (bold right angle bracket) Separates levels in a hierarchy of menu selections. In the configuration editor hierarchy, select Protocols>Ospf. Documentation Feedback We encourage you to provide feedback, comments, and suggestions so that we can improve the documentation. You can provide feedback by using either of the following methods: Online feedback rating system On any page at the Juniper Networks Technical Documentation site at simply click the stars to rate the content, and use the pop-up form to provide us with information about your experience. Alternately, you can use the online feedback form at xv

16 Juniper Secure Analytics Users Guide Send your comments to Include the document or topic name, URL or page number, and software version (if applicable). Requesting Technical Support Technical product support is available through the Juniper Networks Technical Assistance Center (JTAC). If you are a customer with an active J-Care or Partner Support Service support contract, or are covered under warranty, and need post-sales technical support, you can access our tools and resources online or open a case with JTAC. JTAC policies For a complete understanding of our JTAC procedures and policies, review the JTAC User Guide located at Product warranties For product warranty information, visit JTAC hours of operation The JTAC centers have resources available 24 hours a day, 7 days a week, 365 days a year. Self-Help Online Tools and Resources For quick and easy problem resolution, Juniper Networks has designed an online self-service portal called the Customer Support Center (CSC) that provides you with the following features: Find CSC offerings: Search for known bugs: Find product documentation: Find solutions and answer questions using our Knowledge Base: Download the latest versions of software and review release notes: Search technical bulletins for relevant hardware and software notifications: Join and participate in the Juniper Networks Community Forum: Open a case online in the CSC Case Management tool: To verify service entitlement by product serial number, use our Serial Number Entitlement (SNE) Tool: Opening a Case with JTAC You can open a case with JTAC on the Web or by telephone. Use the Case Management tool in the CSC at Call JTAC ( toll-free in the USA, Canada, and Mexico). xvi

17 About the Documentation For international or direct-dial options in countries without toll-free numbers, see xvii

18 Juniper Secure Analytics Users Guide xviii

19 PART 1 Juniper Secure Analytics Users Guide Understanding Juniper Secure Analytics on page 3 Managing Dashboard on page 13 Offense Management on page 29 Log Activity Investigation on page 61 Network Activity Investigation on page 83 Chart Management on page 101 Data Searches on page 107 Custom Event and Flow Properties on page 133 Managing Rule on page 143 Assets Profile Page Parameters on page 165 Managing Report on page 191 1

20 Juniper Secure Analytics Users Guide 2

21 CHAPTER 1 Understanding Juniper Secure Analytics JSA Overview This chapter describes about the following sections: JSA Overview on page 3 Supported Web Browsers on page 4 Enabling Document Mode and Browser Mode in Internet Explorer on page 4 Accessing JSA on page 5 Understanding User Interface Tabs on page 5 Understanding JSA Common Procedures on page 7 Juniper Secure Analytics (JSA) is a network security management platform that provides situational awareness and compliance support through the combination of flow-based network knowledge, security event correlation, and asset-based vulnerability assessment. Default license key A default license key provides access to the user interface for five weeks. After you log in to JSA, a window displays the date that the temporary license key expires. For more information about installing a license key, see the Juniper Secure Analytics Administration Guide. Security exceptions and certificates If you are using the Mozilla Firefox web browser, you must add an exception to Mozilla Firefox to log in to JSA. For more information, see your Mozilla Firefox web browser documentation. If you are using the Microsoft Internet Explorer web browser, a website security certificate message is displayed when you access the JSA system. You must select the Continue to this website option to log in to JSA. Navigate the web-based application When you use JSA, use the navigation options available in the JSA user interface instead of your web browser Back button. Related Documentation Supported Web Browsers on page 4 Enabling Document Mode and Browser Mode in Internet Explorer on page 4 3

22 Juniper Secure Analytics Users Guide Accessing JSA on page 5 Supported Web Browsers For the features in Juniper Secure Analytics (JSA) products to work properly, you must use a supported web browser. When you access the JSA system, you are prompted for a user name and a password. The user name and password must be configured in advance by the administrator. Table 3 on page 4 lists the supported versions of web browsers. Table 3: Supported Web Browsers For JSA Products Web browser Supported version Mozilla Firefox 10.0 Extended Support Release (ESR) Microsoft Internet Explorer, with document mode and browser mode enabled Google Chrome Latest version Related Documentation Enabling Document Mode and Browser Mode in Internet Explorer on page 4 Accessing JSA on page 5 JSA Overview on page 3 Enabling Document Mode and Browser Mode in Internet Explorer If you use Microsoft Internet Explorer to access Juniper Secure Analytics (JSA) products, you must enable browser mode and document mode. To enable browser and document mode: 1. In your Internet Explorer web browser, press F12 to open the Developer Tools window. 2. Click Browser Mode and select the version of your web browser. 3. Click Document Mode and select Internet Explorer 7.0 Standards. Related Documentation Supported Web Browsers on page 4 Accessing JSA on page 5 Understanding User Interface Tabs on page 5 4

23 Chapter 1: Understanding Juniper Secure Analytics Accessing JSA Juniper Secure Analytics (JSA) is a web-based application. JSA uses default login information for the URL, user name, and password. Table 4 on page 5 provides the login information in to your JSA console. Table 4: Default Login Information for JSA Login information Default URL Address>, Where <IP Address> is the IP address of the JSA console. User name admin Password The password that is assigned to JSA during the installation process. License key A default license key provides you access to the system for 5 weeks. Related Documentation JSA Overview on page 3 Supported Web Browsers on page 4 Enabling Document Mode and Browser Mode in Internet Explorer on page 4 Understanding User Interface Tabs on page 5 Understanding JSA Common Procedures on page 7 Understanding User Interface Tabs Functionality is divided into tabs. The Dashboard tab is displayed when you log in. You can easily navigate the tabs to locate the data or functionality you require. Dashboard tab The Dashboard tab is the default tab that is displayed when you log in. The Dashboard tab provides a workspace environment that supports multiple dashboards on which you can display your views of network security, activity, or data that JSA collects. Five default dashboards are available. Each dashboard contains items that provide summary and detailed information about offenses that occur on your network. You can also create a custom dashboard to allow you to focus on your security or network operations responsibilities. For more information about using the Dashboard tab, see Network Tab Overview on page 83. The Dashboard tab is the default tab that is displayed when you log in to Log Analytics. It provides a workspace environment that provides summary and detailed information on events occurring in your network. Offenses tab 5

24 Juniper Secure Analytics Users Guide The Offenses tab will allow you to view offenses that occur on your network, which you can locate by using various navigation options or through powerful searches. From the Offenses tab, you can investigate an offense to determine the root cause of an issue. You can also resolve the issue. For more information about Offenses tab, see Offense Management on page 29. Log activity tab The Log Activity tab will allow you to investigate event logs being sent to JSA in real-time, perform powerful searches, and view log activity by using configurable time-series charts. The Log Activity tab will allow you to perform in-depth investigations on event data. For more information, see Log Activity Investigation on page 61. Network activity tab Use the Network Activity tab to investigate flows that are sent in real-time, perform powerful searches, and view network activity by using configurable time-series charts. A flow is a communication session between two hosts. Viewing flow information will allow you to determine how the traffic is communicated, what is communicated (if the content capture option is enabled), and who is communicating. Flow data also includes details such as protocols, ASN values, IFIndex values, and priorities. For more information, see Network Tab Overview on page 83. Assets tab JSA automatically discovers assets, servers, and hosts, operating on your network. Automatic discovery is based on passive flow data and vulnerability data, allowing JSA to build an asset profile. Asset profiles provide information about each known asset in your network, including identity information, if available, and what services are running on each asset. This profile data is used for correlation purposes to help reduce false positives. For example, an attack tries to use a specific service that is running on a specific asset. In this situation, JSA can determine whether the asset is vulnerable to this attack by correlating the attack to the asset profile. Using the Assets tab, you can view the learned assets or search for specific assets to view their profiles. For more information, see Assets Profile Page Parameters on page

25 Chapter 1: Understanding Juniper Secure Analytics Reports tab The Reports tab will allow you to create, distribute, and manage reports for any data within JSA. The Reports feature will allow you to create customized reports for operational and executive use. To create a report, you can combine information (such as, security or network) into a single report. You can also use preinstalled report templates that are included with JSA. The Reports tab also will allow you to brand your reports with customized logos. This customization is beneficial for distributing reports to different audiences. For more information about reports, see Report Management Overview on page 191. Admin tab Administrators use the Admin tab to configure and manage the users, systems, networks, plug-ins, and components. Users with administration privileges can access the Admin tab. Table 5 on page 7 describes the administration tools that administrators can access in the Admin. Table 5: Administration Management Tools Available in JSA Admin tool System Configuration Configure system and user management options. Data Sources Configure log sources, flow sources, and vulnerability options. Remote Networks and Services Configuration Configure remote networks and services groups. Plug-ins This option is only displayed if there are plug-ins that are installed on your console. Deployment Editor Manage the individual components of your JSA deployment. All configuration updates that you make in the Admin tab are saved to a staging area. When all changes are complete, you can deploy the configuration updates to the managed host in your deployment. Related Documentation Enabling Document Mode and Browser Mode in Internet Explorer on page 4 Accessing JSA on page 5 Understanding JSA Common Procedures on page 7 Understanding JSA Common Procedures Various controls on the JSA user interface are common to most user interface tabs. 7

26 Juniper Secure Analytics Users Guide Viewing Messages The Messages menu, which is on the upper right corner of the user interface, provides access to a window in which you can read and manage your system notifications. For system notifications to show on the Messages window, the administrator must create a rule that is based on each notification message type and select the Notify check box in the Custom Rules Wizard. The Messages menu indicates how many unread system notifications you have in your system. This indicator increments the number until you close system notifications. For each system notification, the Messages window provides a summary and the date stamp for when the system notification was created. You can hover your mouse pointer over a notification to view more detail. Using the functions on the Messages window, you can manage the system notifications. System notifications are also available on the Dashboard tab and on an optional pop-up window that can be displayed on the lower left corner of the user interface. Actions that you perform in the Messages window are propagated to the Dashboard tab and the pop-up window. For example, if you close a system notification from the Messages window, the system notification is removed from all system notification displays. For more information about Dashboard system notifications, see Managing System Notifications on page 26. Table 6 on page 8 provides the Messages window functions. Table 6: Functions Available in the Messages Window Function All Click All to view all system notifications. This option is the default, therefore, you click All only if you selected another option and want to display all system notifications again. Health Click Health to view only system notifications that have a severity level of Health. Errors Click Errors to view only system notifications that have a severity level of Error. Warnings Click Warnings to view only the system notifications that have a severity level of Warning. Information Click Information to view only the system notifications that have a severity level of information. Dismiss All Click Dismiss All to close all system notifications from your system. If you filtered the list of system notifications by using the Health, Errors, Warnings, or Information icons, the text on the View All icon changes to one of the following options: Dismiss All Errors Dismiss All Health Dismiss All Warnings Dismiss All Info 8

27 Chapter 1: Understanding Juniper Secure Analytics Table 6: Functions Available in the Messages Window (continued) Function View All Click View All to view the system notification events in the Log Activity tab. If you filtered the list of system notifications by using the Health, Errors, Warnings, or Information icons, the text on the View All icon changes to one of the following options: View All Errors View All Health View All Warnings View All Info Dismiss Click the Dismiss icon beside a system notification to close the system notification from your system. To view messages: 1. Log in to JSA. 2. On the upper right corner of the user interface, click Messages. 3. On the Messages window, view the system notification details. 4. Optional. To refine the list of system notifications, click one of the following options: Errors Warnings Information 5. Optional. To close system notifications, choose of the following options: Option Dismiss All Click to close all system notifications. Dismiss Click the Dismiss icon next to the system notification that you want to close. 6. Optional. To view the system notification details, hover your mouse pointer over the system notification. Sorting Results You sort the results in tables by clicking a column heading. An arrow at the top of the column indicates the direction of the sort. To sort results: 1. Log in to JSA. 2. Click the column header once to sort the table in descending order; twice to sort the table in ascending order. 9

28 Juniper Secure Analytics Users Guide Refreshing and Pausing the User Interface You can manually refresh, pause, and play the data that is displayed on tabs. The Dashboard and Offenses tabs automatically refresh every 60 seconds. The Log Activity and Network Activity tabs automatically refresh every 60 seconds if you are viewing the tab in Last Interval (auto refresh) mode. The Log Activity tab automatically refreshes every 60 seconds if you are viewing the tab in Last Interval (auto refresh) mode. The timer, which is on the upper right corner of the interface, indicates the amount of time until the tab is automatically refreshed. When you view the Log Activity or Network Activity tab in Real Time (streaming) or Last Minute (auto refresh) mode, you can use the Pause icon to pause the current display. When you view the Log Activity tab in Real Time (streaming) or Last Minute (auto refresh) mode, you can use the Pause icon to pause the current display. You can also pause the current display in the Dashboard tab. Clicking anywhere inside a dashboard item automatically pauses the tab. The timer flashes red to indicate that the current display is paused. To refresh or pause the user interface: 1. Log in to JSA. 2. Click the tab that you want to view. 3. Choose one of the following options: Option Refresh Click Refresh, on the right corner of the tab, to refresh the tab. Pause Click to pause the display on the tab. Play Click to restart the timer after the timer is paused. Investigate User Names You can right-click a user name to access more menu options. Use these options to view more information about the user name or IP address. Table 7 on page 11 describes the menu options for user name investigation. 10

29 Chapter 1: Understanding Juniper Secure Analytics Table 7: Menu Options for User Name Investigation Option View Assets Displays current assets that are associated to the selected user name. For more information about viewing assets, see Assets Profile Page Parameters on page 165. View User History Displays all assets that are associated to the selected user name over the previous 24 hours. View Events Displays the events that are associated to the selected user name. For more information about the List of Events window, see Log Activity Monitoring on page 65. For more information about customizing the right-click menu, see the Juniper Secure Analytics Administration Guide. System Time The right corner of the JSA user interface displays system time, which is the time on the console. The console time synchronizes JSA systems within the JSA deployment. The console time is used to determine what time events were received from other devices for correct time synchronization correlation. In a distributed deployment, the console might be in a different time zone from your desktop computer. When you apply time-based filters and searches on the Log Activity and Network Activity tabs, you must use the console system time to specify a time range. When you apply time-based filters and searches on the Log Activity tab, you must use the console system time to specify a time range. Updating user details You can update your user details through the main JSA user interface: To update user details: 1. To access your user information, click Preferences. 2. As required, update the following parameters: Option Username Displays your user name. You cannot edit this field. Password Type a new password. The password must meet the following criteria: Minimum of six characters Maximum of 255 characters Contain at least one special character Contain at least one special character Contain one uppercase character 11

30 Juniper Secure Analytics Users Guide Option Password (Confirm) Type the password again for confirmation. Address Type your address. The address must meet the following requirements: Valid address Minimum of 10 characters Maximum of 255 characters Enable Popup Notifications Select this check box if you want to enable pop-up system notifications to be displayed on your user interface. Access Online Help You can access the JSA Online Help through the main JSA user interface. To access the Online Help, click Help > Help Contents. Resize Columns You can resize the columns on several tabs in JSA. Place the pointer of your mouse over the line that separates the columns and drag the edge of the column to the new location. You can also resize columns by double-clicking the line that separates the columns to automatically resize the column to the width of the largest field. NOTE: Column resizing does not work in Microsoft Internet Explorer, Version 7.0 web browsers when tabs are displaying records in streaming mode. Configure Page Size Users with administrative privileges can configure the maximum number of results that display in the tables on various tabs in JSA. Related Documentation JSA Overview on page 3 Enabling Document Mode and Browser Mode in Internet Explorer on page 4 Accessing JSA on page 5 12