Juniper Secure Analytics

Transcription

1 Juniper Secure Analytics Log Sources Users Guide Release Modified:

2 Juniper Networks, Inc Innovation Way Sunnyvale, California USA All rights reserved. Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. Juniper Secure Analytics Log Sources Users Guide All rights reserved. The information in this document is current as of the date on the title page. YEAR 2000 NOTICE Juniper Networks hardware and software products are Year 2000 compliant. Junos OS has no known time-related limitations through the year However, the NTP application is known to have some difficulty in the year END USER LICENSE AGREEMENT The Juniper Networks product that is the subject of this technical documentation consists of (or is intended for use with) Juniper Networks software. Use of such software is subject to the terms and conditions of the End User License Agreement ( EULA ) posted at By downloading, installing or using such software, you agree to the terms and conditions of that EULA. ii

3 Table of Contents About the Documentation vii Documentation and Release Notes vii Documentation Conventions vii Documentation Feedback ix Requesting Technical Support x Self-Help Online Tools and Resources x Opening a Case with JTAC x Part 1 Juniper Secure Analytics Log Sources Chapter 1 Installing Protocols Installing Protocols Chapter 2 Managing Log Sources Log Sources Management Adding a Log Source Blue Coat Web Security Service REST API protocol configuration options Configuring the Cisco NSEL Protocol Configuring the EMC VMware Protocol Configuring the IBM Tivoli Endpoint Manager SOAP Protocol Configuring the JDBC Protocol Configuring the JDBC - SiteProtector Protocol Configuring the Juniper Networks NSM Protocol Configuring the Juniper Security Binary Log Collector Protocol Configuring the Log File Protocol Configuring the Microsoft DHCP Protocol Configuring the Microsoft Exchange Protocol Configuring the Microsoft IIS protocol Configuring the Microsoft Security Event Log Protocol MQ protocol configuration options Okta REST API protocol configuration options Configuring the OPSEC/LEA Protocol Configuring the Oracle Database Listener Protocol Configuring the PCAP Syslog Combination Protocol Configuring the SDEE Protocol Configuring the SMB Tail Protocol Configuring the SNMPv2 Protocol Configuring the SNMPv3 Protocol Seculert Protection REST API protocol configuration options Configuring the Sophos Enterprise Console JDBC Protocol Configuring the Sourcefire Defense Center Estreamer Protocol iii

4 Juniper Secure Analytics Log Sources Users Guide Syslog Redirect protocol overview Configuring the TCP Multiline Syslog Protocol Configuring the TLS Syslog Protocol Configuring the UDP Multiline Syslog Protocol Configuring the VMware vcloud Director Protocol Adding Bulk Log Sources Log Source Parsing Order Overview Adding a Log Source Parsing Order Chapter 3 Log Source Extensions Log Source Extensions Overview Patterns in log source extension documents Match Groups Matcher (matcher) Multi-event modifier (event-match-multiple) Single-event modifier (event-match-single) Extension document template Extension document example for parsing one event type Parsing basics Event name and device event category IP address and port patterns Creating a log source extensions document Building a Universal DSM Exporting the logs Common regular expressions Building regular expression patterns Uploading extension documents to JSA Mapping unknown events Parsing issues and examples Converting a protocol Making a single substitution Generating a colon-separated MAC address Combining IP address and port Modifying an Event Category Suppressing identity change events Encoding logs Formatting event dates and time stamps Multiple Log Formats in a Single Log Source Parsing a CSV log format Log Source Type IDs Chapter 4 Managing Log Source Extensions Log Source Extensions Overview Adding a Log Source Extension Part 2 Index Index iv

5 List of Tables About the Documentation vii Table 1: Notice Icons viii Table 2: Text and Syntax Conventions viii Part 1 Juniper Secure Analytics Log Sources Chapter 2 Managing Log Sources Table 3: Log Source parameters Table 4: Blue Coat Web Security Service REST API protocol parameters Table 5: Cisco NSEL Protocol Parameters Table 6: EMC VMware Protocol Parameters Table 7: IBM Tivoli Endpoint Manager SOAP Protocol Parameters Table 8: JDBC Protocol Parameters Table 9: JDBC - SiteProtector Protocol Parameters Table 10: Juniper Networks NSM Protocol Parameters Table 11: Juniper Security Binary Log Collector Protocol Parameters Table 12: Log File Protocol Parameters Table 13: Microsoft DHCP Protocol Parameters Table 14: Microsoft Exchange Protocol Parameters Table 15: Microsoft IIS Protocol Parameters Table 16: Microsoft Security Event Log Protocol Parameters Table 17: MQ protocol parameters Table 18: Okta REST API protocol parameters Table 19: OPSEC/LEA Protocol Parameters Table 20: Oracle Database Listener Protocol Parameters Table 21: PCAP Syslog Combination Protocol Parameters Table 22: SDEE Protocol Parameters Table 23: SMB Tail Protocol Parameters Table 24: SNMPv2 Protocol Parameters Table 25: SNMPv3 Protocol Parameters Table 26: Seculert Protection REST API protocol parameters Table 27: Sophos Enterprise Console JDBC Protocol Parameters Table 28: Sourcefire Defense Center Estreamer Protocol Parameters Table 29: Syslog Redirect protocol parameters Table 30: TCP Multiline Syslog Protocol Parameters Table 31: TLS Syslog Protocol Parameters Table 32: UDP Multiline Syslog Protocol Parameters Table 33: VMware vcloud Director Protocol Parameters Chapter 3 Log Source Extensions Table 34: of pattern parameters v

6 Juniper Secure Analytics Log Sources Users Guide Table 35: of match group parameters Table 36: of matcher parameters Table 37: List of valid matcher field names Table 38: of single-event parameters Table 39: Common regex expressions Table 40: Translating pseudo-code to regular expressions Table 41: Mapping regular expressions to capture groups for event fields Table 42: Log Source Type ID Chapter 4 Managing Log Source Extensions Table 43: Use Condition List vi

7 About the Documentation Documentation and Release Notes Documentation and Release Notes on page vii Documentation Conventions on page vii Documentation Feedback on page ix Requesting Technical Support on page x Documentation Conventions To obtain the most current version of all Juniper Networks technical documentation, see the product documentation page on the Juniper Networks website at If the information in the latest release notes differs from the information in the documentation, follow the product Release Notes. Juniper Networks Books publishes books by Juniper Networks engineers and subject matter experts. These books go beyond the technical documentation to explore the nuances of network architecture, deployment, and administration. The current list can be viewed at Table 1 on page viii defines notice icons used in this guide. vii

8 Juniper Secure Analytics Log Sources Users Guide Table 1: Notice Icons Icon Meaning Informational note Indicates important features or instructions. Caution Indicates a situation that might result in loss of data or hardware damage. Warning Alerts you to the risk of personal injury or death. Laser warning Alerts you to the risk of personal injury from a laser. Tip Indicates helpful information. Best practice Alerts you to a recommended use or implementation. Table 2: Text and Syntax Conventions Table 2 on page viii defines the text and syntax conventions used in this guide. Convention Examples Bold text like this Represents text that you type. To enter configuration mode, type the configure command: user@host> configure Fixed-width text like this Italic text like this Represents output that appears on the terminal screen. Introduces or emphasizes important new terms. Identifies guide names. Identifies RFC and Internet draft titles. user@host> show chassis alarms No alarms currently active A policy term is a named structure that defines match conditions and actions. Junos OS CLI User Guide RFC 1997, BGP Communities Attribute Italic text like this Represents variables (options for which you substitute a value) in commands or configuration statements. Configure the machine s domain name: [edit] root@# set system domain-name domain-name viii

9 About the Documentation Table 2: Text and Syntax Conventions (continued) Convention Examples Text like this Represents names of configuration statements, commands, files, and directories; configuration hierarchy levels; or labels on routing platform components. To configure a stub area, include the stub statement at the [edit protocols ospf area area-id] hierarchy level. The console port is labeled CONSOLE. < > (angle brackets) Encloses optional keywords or variables. stub <default-metric metric>; (pipe symbol) Indicates a choice between the mutually exclusive keywords or variables on either side of the symbol. The set of choices is often enclosed in parentheses for clarity. broadcast multicast (string1 string2 string3) # (pound sign) Indicates a comment specified on the same line as the configuration statement to which it applies. rsvp { # Required for dynamic MPLS only [ ] (square brackets) Encloses a variable for which you can substitute one or more values. community name members [ community-ids ] Indention and braces ( { } ) ; (semicolon) Identifies a level in the configuration hierarchy. Identifies a leaf statement at a configuration hierarchy level. [edit] routing-options { static { route default { nexthop address; retain; } } } GUI Conventions Bold text like this Represents graphical user interface (GUI) items you click or select. In the Logical Interfaces box, select All Interfaces. To cancel the configuration, click Cancel. > (bold right angle bracket) Separates levels in a hierarchy of menu selections. In the configuration editor hierarchy, select Protocols>Ospf. Documentation Feedback We encourage you to provide feedback, comments, and suggestions so that we can improve the documentation. You can provide feedback by using either of the following methods: Online feedback rating system On any page of the Juniper Networks TechLibrary site at simply click the stars to rate the content, and use the pop-up form to provide us with information about your experience. Alternately, you can use the online feedback form at ix

10 Juniper Secure Analytics Log Sources Users Guide Send your comments to Include the document or topic name, URL or page number, and software version (if applicable). Requesting Technical Support Technical product support is available through the Juniper Networks Technical Assistance Center (JTAC). If you are a customer with an active J-Care or Partner Support Service support contract, or are covered under warranty, and need post-sales technical support, you can access our tools and resources online or open a case with JTAC. JTAC policies For a complete understanding of our JTAC procedures and policies, review the JTAC User Guide located at Product warranties For product warranty information, visit JTAC hours of operation The JTAC centers have resources available 24 hours a day, 7 days a week, 365 days a year. Self-Help Online Tools and Resources For quick and easy problem resolution, Juniper Networks has designed an online self-service portal called the Customer Support Center (CSC) that provides you with the following features: Find CSC offerings: Find product documentation: Find solutions and answer questions using our Knowledge Base: Download the latest versions of software and review release notes: Search technical bulletins for relevant hardware and software notifications: Join and participate in the Juniper Networks Community Forum: Open a case online in the CSC Case Management tool: To verify service entitlement by product serial number, use our Serial Number Entitlement (SNE) Tool: Opening a Case with JTAC You can open a case with JTAC on the Web or by telephone. Use the Case Management tool in the CSC at Call JTAC ( toll-free in the USA, Canada, and Mexico). x

11 About the Documentation For international or direct-dial options in countries without toll-free numbers, see xi

12 Juniper Secure Analytics Log Sources Users Guide xii

13 PART 1 Juniper Secure Analytics Log Sources Installing Protocols on page 3 Managing Log Sources on page 5 Log Source Extensions on page 35 Managing Log Source Extensions on page 73 1

14 Juniper Secure Analytics Log Sources Users Guide 2

15 CHAPTER 1 Installing Protocols Installing Protocols This chapter describes about the following sections: Installing Protocols on page 3 You can download and install a Juniper Secure Analytics (JSA) protocol. To install JSA protocols: 1. Download the protocol file from Juniper Customer Support: 2. Copy the protocol file to your JSA console. 3. Using SSH, log in to the JSA host as the root user. 4. Navigate to the directory that includes the downloaded file. 5. Extract the contents of the file if they are compressed. 6. Type the following command: rpm -Uvh <filename> Where <filename> is the name of the downloaded file. For example: PROTOCOL-WinCollectMicrosoftIAS noarch.rpm. 7. Log in to JSA. Address> Where <IP Address> is the IP address of the JSA console or Event Collector. 8. On the Admin tab, click Deploy Changes. The installation is complete. Related Documentation Log Sources Management on page 6 Adding a Log Source on page 6 3

16 Juniper Secure Analytics Log Sources Users Guide 4

17 CHAPTER 2 Managing Log Sources This chapter describes about the following sections: Log Sources Management on page 6 Adding a Log Source on page 6 Blue Coat Web Security Service REST API protocol configuration options on page 8 Configuring the Cisco NSEL Protocol on page 8 Configuring the EMC VMware Protocol on page 9 Configuring the IBM Tivoli Endpoint Manager SOAP Protocol on page 10 Configuring the JDBC Protocol on page 10 Configuring the JDBC - SiteProtector Protocol on page 12 Configuring the Juniper Networks NSM Protocol on page 13 Configuring the Juniper Security Binary Log Collector Protocol on page 14 Configuring the Log File Protocol on page 14 Configuring the Microsoft DHCP Protocol on page 16 Configuring the Microsoft Exchange Protocol on page 16 Configuring the Microsoft IIS protocol on page 17 Configuring the Microsoft Security Event Log Protocol on page 18 MQ protocol configuration options on page 19 Okta REST API protocol configuration options on page 20 Configuring the OPSEC/LEA Protocol on page 21 Configuring the Oracle Database Listener Protocol on page 22 Configuring the PCAP Syslog Combination Protocol on page 22 Configuring the SDEE Protocol on page 23 Configuring the SMB Tail Protocol on page 23 Configuring the SNMPv2 Protocol on page 24 Configuring the SNMPv3 Protocol on page 25 Seculert Protection REST API protocol configuration options on page 25 Configuring the Sophos Enterprise Console JDBC Protocol on page 26 Configuring the Sourcefire Defense Center Estreamer Protocol on page 28 5

18 Juniper Secure Analytics Log Sources Users Guide Log Sources Management Syslog Redirect protocol overview on page 29 Configuring the TCP Multiline Syslog Protocol on page 29 Configuring the TLS Syslog Protocol on page 30 Configuring the UDP Multiline Syslog Protocol on page 31 Configuring the VMware vcloud Director Protocol on page 32 Adding Bulk Log Sources on page 32 Log Source Parsing Order Overview on page 33 Adding a Log Source Parsing Order on page 33 You can configure Juniper Secure Analytics (JSA) to accept event logs from log sources that are on your network. A log source is a data source that creates an event log. For example, a firewall or Intrusion Protection System (IPS) logs security-based events, and switches or routers logs network-based events. To receive raw events from log sources, JSA supports many protocols. Passive protocols listen for events on specific ports. Active protocols use Application Program Interfaces (APIs) or other communication methods to connect to external systems that poll and retrieve events. Depending on your license limits, JSA can read and interpret events from more than 300 log sources. To configure a log source for JSA, you must do the following tasks: 1. Download and install a Device Support Module (DSM) that supports the log source. A DSM is software application that contains the event patterns that are required to identify and parse events from the original format of the event log to the format that JSA can use. For more information about DSMs and the supported log sources, see the Juniper Secure Analytics Configuring DSMs guide. 2. If automatic discovery is supported for the DSM, wait for JSA to automatically add the log source to your list of configured log sources. 3. If automatic discover is not supported for the DSM, manually create the log source configuration. See: Adding a Log Source on page 6. Adding Bulk Log Sources on page 32. Adding a Log Source If a log source is not automatically discovered, you can manually add a log source to receive events from your network devices or appliances. Table 3 on page 7 describes the common log source parameters for all log source types. 6

19 Chapter 2: Managing Log Sources Table 3: Log Source parameters Parameter Log Source Identifier The IPv4 address or host name that identifies the log source. If your network contains multiple devices that are attached to a single management console, specify the IP address of the individual device that created the event. A unique identifier for each, such as an IP address, prevents event searches from identifying the management console as the source for all of the events. Enabled When this option is not enabled, the log source does not collect events and the log source is not counted in the license limit. Credibility Credibility is a representation of the integrity or validity of events that are created by a log source. The credibility value that is assigned to a log source can increase or decrease based on incoming events or adjusted as a response to user-created event rules. The credibility of events from log sources contributes to the calculation of the offense magnitude and can increase or decrease the magnitude value of an offense. Target Event Collector Specifies the JSA Event Collector that polls the remote log source. Use this parameter in a distributed deployment to improve JSA console system performance by moving the polling task to an Event Collector. Coalescing Events Increases the event count when the same event occurs multiple times within a short time interval. Coalesced events provide a way to view and determine the frequency with which a single event type occurs on the Log Activity tab. When this check box is clear, events are viewed individually and events are not bundled. New and automatically discovered log sources inherit the value of this check box from the System Settings configuration on the Admin tab. You can use this check box to override the default behavior of the system settings for an individual log source. To add a log source: 1. Click the Admin tab. 2. Click the Log Sources icon. 3. Click Add. 4. Configure the common parameters for your log source. 5. Configure the protocol-specific parameters for your log source. 6. Click Save. 7. On the Admin tab, click Deploy Changes. Related Documentation Log Sources Management on page 6 Adding Bulk Log Sources on page 32. 7

20 Juniper Secure Analytics Log Sources Users Guide Blue Coat Web Security Service REST API protocol configuration options To receive events from Blue Coat Web Security Service, configure a log source to use the Blue Coat Web Security Service REST API protocol. The Blue Coat Web Security Service REST API protocol queries the Blue Coat Web Security Service Sync API and retrieves recently hardened log data from the cloud. The following table describes the protocol-specific parameters for the Blue Coat Web Security Service REST API protocol: Table 4 on page 8 describes the Blue Coat Web Security Service REST API protocol parameters. Table 4: Blue Coat Web Security Service REST API protocol parameters Parameter API Username The API user name that is used for authenticating with the Blue Coat Web Security Service. The API user name is configured through the Blue Coat Threat Pulse Portal. Password The password that is used for authenticating with the Blue Coat Web Security Service. Confirm Password Confirmation of the Password field. Use Proxy When you configure a proxy, all traffic for the log source travels through the proxy for JSA to access the Blue Coat Web Security Service. Configure the Proxy IP or Hostname, Proxy Port, Proxy Username, and Proxy Password fields. If the proxy does not require authentication, you can leave the Proxy Username and Proxy Password fields blank. Automatically Acquire Server Certificate(s) If you select Yes from the list, JSA downloads the certificate and begins trusting the target server. Recurrence You can specify when the log collects data. The format is M/H/D for Months/Hours/Days. The default is 5 M. EPS Throttle The upper limit for the maximum number of events per second (EPS). The default is Related Documentation Log Sources Management on page 6 Adding Bulk Log Sources on page 32 Configuring the Cisco NSEL Protocol To monitor NetFlow packet flows from a Cisco Adaptive Security Appliance (ASA), configure the Cisco Network Security Event Logging (NSEL) protocol source. To integrate Cisco ASA using NetFlow with JSA, you must manually create a log source to receive NetFlow events. JSA does not automatically discover or create log sources for 8

21 Chapter 2: Managing Log Sources syslog events from Cisco ASA using NetFlow and NSEL. For more information, see the Juniper Secure Analytics Configuring DSMs. Table 5 on page 9 describes the protocol-specific parameters for the Cisco NSEL protocol. Table 5: Cisco NSEL Protocol Parameters Parameter Protocol Configuration Cisco NSEL Log Source Identifier If the network contains devices that are attached to a management console, administrators can specify the IP address of the individual device that created the event. A unique identifier for each, such as an IP address, prevents event searches from identifying the management console as the source for all of the events. Collector Port The UDP port number that Cisco ASA uses to forward NSEL events. JSA uses port 2055 for flow data on JSA Flow Processors. You must assign a different UDP port on the Cisco Adaptive Security Appliance for NetFlow. Related Documentation Configuring the TCP Multiline Syslog Protocol on page 29. Configuring the VMware vcloud Director Protocol on page 32. Configuring the EMC VMware Protocol To receive event data from the VMWare web service for virtual environments, configure a log source to use the EMC VMWare protocol. Table 6 on page 9 describes the protocol-specific parameters for the EMC VMware protocol. Table 6: EMC VMware Protocol Parameters Parameter Protocol Configuration EMC VMware Log Source Identifier The value for this parameter must match the VMware IP parameter. VMware IP The IP address of the VMWare ESXi server, for example, The VMware protocol appends the IP address of your VMware ESXi server with HTTPS before the protocol requests event data. Related Documentation Configuring the JDBC Protocol on page 10. Configuring the JDBC - SiteProtector Protocol on page 12. 9

22 Juniper Secure Analytics Log Sources Users Guide Configuring the IBM Tivoli Endpoint Manager SOAP Protocol To receive Log Extended Event Format (LEEF) formatted events from IBM Tivoli Endpoint Manager appliances, configure a log source that uses the IBM Tivoli Endpoint Manager SOAP protocol. This protocol requires IBM Tivoli Endpoint Manager versions V8.2.x or later and the Web Reports application for Tivoli Endpoint Manager. The Tivoli Endpoint Manager SOAP protocol retrieves events in 30-second intervals over HTTP or HTTPS. As events are retrieved, the IBM Tivoli Endpoint Manager DSM parses and categorizes the events. Table 7 on page 10 describes the protocol-specific parameters for the IBM Tivoli Endpoint Manager SOAP protocol. Table 7: IBM Tivoli Endpoint Manager SOAP Protocol Parameters Parameter Protocol Configuration IBM Tivoli Endpoint Manager SOAP Use HTTPS If a certificate is required to connect with HTTPS, administrators must copy any certificates that are required to the following directory: /opt/jsa/conf/ trusted_certificates. Certificates with the following file extensions:.crt,.cert, or.der are supported. SOAP Port By default, port 80 is the port number for communicating with IBM Tivoli Endpoint Manager. Most configurations use port 443 for HTTPS communications. Related Documentation Configuring the TLS Syslog Protocol on page 30. Configuring the Juniper Security Binary Log Collector Protocol on page 14. Configuring the JDBC Protocol Juniper Secure Analytics (JSA) uses the Java Database Connectivity (JDBC) protocol to collect information from tables or views that contain event data from several database types. Table 8 on page 10 describes the protocol-specific parameters for the JDBC protocol. Table 8: JDBC Protocol Parameters Parameter Database Type From the list box, select the type of database that contains the events. Database Name The database name must match the database name that is specified in the Log Source Identifier field. 10

23 Chapter 2: Managing Log Sources Table 8: JDBC Protocol Parameters (continued) Parameter Port The JDBC port must match the listen port that is configured on the remote database. The database must permit incoming TCP connections. If a Database Instance is used with the MSDE database type, administrators must leave the Port parameter blank in the log source configuration. Username A user account for JSA in the database. Authentication Domain A domain must be configured for MSDE databases that are within a Windows domain. If your network does not use a domain, leave this field blank. Database Instance The database instance, if required. MSDE databases can include multiple SQL server instances on one server. When a non-standard port is used for the database or access is blocked to port 1434 for SQL database resolution, the Database Instance parameter must be blank in the log source configuration. Predefined Query Optional. Table Name The name of the table or view that includes the event records. The table name can include the following special characters: dollar sign ($), number sign (#), underscore (_), en dash (-), and period (.). Select List The list of fields to include when the table is polled for events. You can use a comma-separated list or type * to select all fields from the table or view. If a comma-separated list is defined, the list must contain the field that is defined in the Compare Field. Compare Field A numeric value or time stamp field from the table or view that identifies new events that are added to the table between queries. Enables the protocol to identify events that were previously polled by the protocol to ensure that duplicate events are not created. Use Prepared Statements Prepared statements enable the JDBC protocol source to set up the SQL statement, and then run the SQL statement numerous times with different parameters. For security and performance reasons, most JDBC protocol configurations can use prepared statements. Start Date and Time If a start time is not defined, the protocol attempts to poll for events after the log source configuration is saved and deployed. Polling Interval The default polling interval is 10 seconds. EPS Throttle The upper limit for the permitted number of Events Per Second (EPS). Use Named Pipe Communication Named pipe connections for MSDE databases require that the user name and password field use a Windows authentication user name and password instead of the database user name and password. The log source configuration must use the default named pipe on the MSDE database. Use NTLMv2 The Use NTLMv2 check box does not interrupt communications for MSDE connections that do not require NTLMv2 authentication. 11

24 Juniper Secure Analytics Log Sources Users Guide Related Documentation Configuring the Sophos Enterprise Console JDBC Protocol on page 26. Configuring the Juniper Networks NSM Protocol on page 13. Configuring the OPSEC/LEA Protocol on page 21. Configuring the JDBC - SiteProtector Protocol To receive events from remote JSA Proventia Management SiteProtector databases, configure a log source to use the Java Database Connectivity (JDBC) - SiteProtector protocol. The JDBC - SiteProtector protocol combines information from the SensorData1 and SensorDataAVP1 tables in the creation of the log source payload. The SensorData1 and SensorDataAVP1 tables are in the JSA Proventia Management SiteProtector database. The maximum number of rows that the JDBC - SiteProtector protocol can poll in a single query is 30,000 rows. Table 9 on page 12 describes the protocol-specific parameters for the JDBC - SiteProtector protocol. Table 9: JDBC - SiteProtector Protocol Parameters Parameter Protocol Configuration JDBC - SiteProtector Database Type MSDE Database Name Type RealSecureDB the name of the database to which the protocol can connect. Port The JDBC - SiteProtector configuration port must match the listener port of the database. The database must have incoming TCP connections enabled. If you define a Database Instance when with MSDE as the database type, you must leave the Port parameter blank. Authentication Domain If you select MSDE and the database is configured for Windows, you must define a Windows domain. If your network does not use a domain, leave this field blank. Database Instance If you select MSDE and you have multiple SQL server instances on one server, define the instance to which you want to connect. If you use a non-standard port in your database configuration, or have blocked access to port 1434 for SQL database resolution, you must leave the Database Instance parameter blank in your configuration Table Name SensorData1 AVP View Name SensorDataAVP Response View Name SensorDataResponse 12

25 Chapter 2: Managing Log Sources Table 9: JDBC - SiteProtector Protocol Parameters (continued) Parameter Select List Type * to include all fields from the table or view. Compare Field SensorDataRowID Use Prepared Statements Prepared statements allow the JDBC protocol source to set up the SQL statement, and then execute the SQL statement numerous times with different parameters. For security and performance reasons, use prepared statements. You can clear this check box to use an alternative method of querying that does not use pre-compiled statements. EPS Throttle The number of Events Per Second (EPS) that you do not want this protocol to exceed. Use Named Pipe Communication If you select MSDE as the database type, select the check box to use an alternative method to a TCP/IP port connection. When you use a Named Pipe connection, the user name and password must be the appropriate Windows authentication username and password and not the database user name and password. The log source configuration must use the default named pipe. Database Cluster Name The cluster name to ensure that named pipe communications function properly. Use NTLMv2 Forces MSDE connections to use the NTLMv2 protocol with SQL servers that require NTLMv2 authentication. The Use NTLMv2 check box does not interrupt communications for MSDE connections that do not require NTLMv2 authentication. Related Documentation Configuring the JDBC Protocol on page 10. Configuring the OPSEC/LEA Protocol on page 21. Configuring the Juniper Networks NSM Protocol To receive Juniper Networks Network and Security Manager (NSM) and Juniper Networks Secure Service Gateway (SSG) logs events, configure a log source to use the Juniper Networks NSM protocol. Table 10 on page 13 describes the protocol-specific parameters for the Juniper Networks Network and Security Manager protocol. Table 10: Juniper Networks NSM Protocol Parameters Parameter Log Source Type Juniper NSM Protocol Configuration Juniper NSM Related Documentation Configuring the JDBC Protocol on page 10. Configuring the JDBC - SiteProtector Protocol on page

26 Juniper Secure Analytics Log Sources Users Guide Configuring the Juniper Security Binary Log Collector Protocol You can configure a log source to use the Security Binary Log Collector protocol. With this protocol, Juniper appliances can send audit, system, firewall, and intrusion prevention system (IPS) events in binary format to JSA. The binary log format from Juniper SRX or J Series appliances are streamed by using the UDP protocol. You must specify a unique port for streaming binary formatted events. The standard syslog port 514 cannot be used for binary formatted events. The default port that is assigned to receive streaming binary events from Juniper appliances is port Table 11 on page 14 describes the protocol-specific parameters for the Juniper Security Binary Log Collector protocol. Table 11: Juniper Security Binary Log Collector Protocol Parameters Parameter Protocol Configuration Security Binary Log Collector XML Template File Location The path to the XML file used to decode the binary stream from your Juniper SRX or Juniper J Series appliance. By default, the device support module (DSM) includes an XML file for decoding the binary stream. The XML file is in the following directory: /opt/jsa/conf/ security_log.xml. Related Documentation Configuring the VMware vcloud Director Protocol on page 32. Configuring the IBM Tivoli Endpoint Manager SOAP Protocol on page 10. Configuring the Log File Protocol To receive events from remote hosts, configure a log source to use the log file protocol. The log file protocol is intended for systems that write daily event logs. It is not appropriate to use the log file protocol for devices that append information to their event files. Log files are retrieved one at a time. The log file protocol can manage plain text, compressed files, or file archives. Archives must contain plain-text files that can be processed one line at a time. When the log file protocol downloads an event file, the information that is received in the file updates the Log Activity tab. If more information is written to the file after the download is complete, the appended information is not processed. Table 12 on page 15 describes the protocol-specific parameters for the Log File protocol. 14

27 Chapter 2: Managing Log Sources Table 12: Log File Protocol Parameters Parameter Protocol Configuration Log File Remote Port If the remote host uses a non-standard port number, you must adjust the port value to retrieve events. SSH Key File The path to the SSH key, if the system is configured to use key authentication. When an SSH key file is used, the Remote Password field is ignored. Remote Directory For FTP, if the log files are in the remote user s home directory, you can leave the remote directory blank. A blank remote directory field supports systems where a change in the working directory (CWD) command is restricted. Recursive This option is ignored for SCP file transfers. FTP File Pattern The regular expression (regex) required to identify the files to download from the remote host. FTP Transfer Mode For ASCII transfers over FTP, you must select NONE in the Processor field and LINEBYLINE in the Event Generator field. Recurrence The time interval to determine how frequently the remote directory is scanned for new event log files. The time interval can include values in hours (H), minutes (M), or days (D). For example, a recurrence of 2H scans the remote directory every 2 hours. Run On Save Starts the log file import immediately after you save the log source configuration. When selected, this check box clears the list of previously downloaded and processed files. After the first file import, the log file protocol follows the start time and recurrence schedule that is defined by the administrator. EPS Throttle The number of Events Per Second (EPS) that the protocol cannot exceed. Change Local Directory? Changes the local directory on the Target Event Collector to store event logs before they are processed. Local Directory The local directory on the Target Event Collector. The directory must exist before the log file protocol attempts to retrieve events. File Encoding The character encoding that is used by the events in your log file. Folder Separator The character that is used to separate folders for your operating system. Most configurations can use the default value in Folder Separator field. This field is intended for operating systems that use a different character to define separate folders. For example, periods that separate folders on mainframe systems. Related Documentation Configuring the JDBC Protocol on page 10. Configuring the JDBC - SiteProtector Protocol on page

28 Juniper Secure Analytics Log Sources Users Guide Configuring the Microsoft DHCP Protocol To receive events from Microsoft DHCP servers, configure a log source to use the Microsoft DHCP protocol. To read the log files, folder paths that contain an administrative share (C$), require NetBIOS privileges on the administrative share (C$). Local or domain administrators have sufficient privileges to access log files on administrative shares. Fields for the Microsoft DHCP protocol that support file paths allow administrators to define a drive letter with the path information. For example, the field can contain the c$/logfiles/ directory for an administrative share, or the LogFiles/directory for a public share folder path, but cannot contain the c:\logfiles directory. NOTE: The Microsoft authentication protocol NTLMv2 is not supported by the Microsoft DHCP protocol. Table 13 on page 16 describes the protocol-specific parameters for the Microsoft DHCP protocol. Table 13: Microsoft DHCP Protocol Parameters Parameter Protocol Configuration Microsoft DHCP Domain Optional. Folder Path The directory path to the DHCP log files. File Pattern The regular expression (regex)that identifies event logs. The log files must contain a three-character abbreviation for a day of the week. Use one of the following file patterns: IPv4 file pattern - DhcpSrvLog-(?:Sun Mon Tue Wed Thu Fri Sat)\.log. IPv6 file pattern - DhcpV6SrvLog-(?:Sun Mon Tue Wed Thu Fri Sat) \.log. Mixed IPv4 and IPv6 file pattern - Dhcp.*SrvLog-(?:Sun Mon Tue Wed Thu Fri Sat) \.log. Related Documentation Configuring the JDBC Protocol on page 10. Configuring the JDBC - SiteProtector Protocol on page 12. Configuring the Microsoft Exchange Protocol To receive events from SMTP, OWA, and Microsoft Exchange 2007 and 2010 servers, configure a log source to use the Microsoft Windows Exchange protocol to support. 16

29 Chapter 2: Managing Log Sources To read the log files, folder paths that contain an administrative share (C$), require NetBIOS privileges on the administrative share (C$). Local or domain administrators have sufficient privileges to access log files on administrative shares. Fields for the Microsoft Exchange protocol that support file paths allow administrators to define a drive letter with the path information. For example, the field can contain the c$/logfiles/ directory for an administrative share, or the LogFiles/directory for a public share folder path, but cannot contain the c:\logfiles directory. NOTE: The Microsoft Exchange protocol does not support Microsoft Exchange 2003 or Microsoft authentication protocol NTLMv2 Session. Table 14 on page 17 describes the protocol-specific parameters for the Microsoft Exchange protocol. Table 14: Microsoft Exchange Protocol Parameters Parameter Protocol Configuration Microsoft Exchange Domain Optional. SMTP Log Folder Path When the folder path is clear, SMTP event collection is disabled. OWA Log Folder Path When the folder path is clear, OWA event collection is disabled. MSGTRK Log Folder Path Message tracking is available on Microsoft Exchange 2007 or 2010 servers assigned the Hub Transport, Mailbox, or Edge Transport server role. File Pattern The regular expression (regex) that identifies the event logs. The default is *\.(?:log LOG). Force File Read If the check box is cleared, the log file is read only when Juniper Secure Analytics (JSA) detects a change in the modified time or file size. Throttle Events/Second The maximum number of events the Exchange protocol can forward per second. Related Documentation Configuring the JDBC Protocol on page 10. Configuring the JDBC - SiteProtector Protocol on page 12. Configuring the Microsoft IIS protocol You can configure a log source to use the Microsoft IIS protocol. This protocol supports a single point of collection for W3C format log files that are located on a Microsoft IIS web server. 17

30 Juniper Secure Analytics Log Sources Users Guide To read the log files, folder paths that contain an administrative share (C$), require NetBIOS privileges on the administrative share (C$). Local or domain administrators have sufficient privileges to access log files on administrative shares. Fields for the Microsoft IIS protocol that support file paths allow administrators to define a drive letter with the path information. For example, the field can contain the c$/logfiles/ directory for an administrative share, or the LogFiles/directory for a public share folder path, but cannot contain the c:\logfiles directory. NOTE: The Microsoft authentication protocol NTLMv2 is not supported by the Microsoft IIS protocol. Table 15 on page 18 describes the protocol-specific parameters for the Microsoft IIS protocol. Table 15: Microsoft IIS Protocol Parameters Parameter Protocol Configuration Microsoft IIS File Pattern The regular expression (regex) that identifies the event logs. Throttle Events/Second The maximum number of events the IIS protocol can forward per second. Related Documentation Configuring the JDBC Protocol on page 10. Configuring the JDBC - SiteProtector Protocol on page 12. Configuring the Microsoft Security Event Log Protocol You can configure a log source to use the Microsoft Security Event Log protocol. You can use Microsoft Windows Management Instrumentation (WMI) to collect customized event logs or agentless Windows Event Logs. The WMI API requires that firewall configurations accept incoming external communications on port 135 and on any dynamic ports that are required for DCOM. The following list describes the log source limitations that you use the Microsoft Security Event Log Protocol: Systems that exceed 50 events per second (eps) might exceed the capabilities of this protocol. Use WinCollect for systems that exceed 50 eps. A Juniper Secure Analytics (JSA) all-in-one installation can support up to 250 log sources with the Microsoft Security Event Log protocol. Dedicated Event Collectors can support up to 500 log sources with the Microsoft Security Event Log protocol. 18

31 Chapter 2: Managing Log Sources The Microsoft Security Event Log protocol is not suggested for remote servers that are accessed over network links. For example, systems with high round-trip delay times, such as satellite or slow WAN networks. Round-trip delay can be confirmed by examining request and response time between a server ping. Network delays that are created by slow connections decrease the EPS throughput available to those remote servers. In addition, event collection from busy servers or Domain Controllers rely on low round-trip delay times to keep up with incoming events. If it is not possible to decrease your network round-trip delay time, administrators can use WinCollect to process Windows events. The Microsoft Security Event Log supports the following software versions with the Microsoft Windows Management Instrumentation (WMI) API: Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008R3 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Table 16 on page 19 describes the protocol-specific parameters for the Microsoft Security Event Log protocol. Table 16: Microsoft Security Event Log Protocol Parameters Parameter Protocol Configuration Windows Security Event Log Related Documentation Configuring the JDBC Protocol on page 10. Configuring the JDBC - SiteProtector Protocol on page 12. MQ protocol configuration options To receive messages from a message queue (MQ) service, configure a log source to use the MQ protocol. The protocol name appears in JSA as MQ JMS. JSA MQ is supported. The MQ protocol can monitor multiple message queues, up to a maximum of 50 per log source. Table 17 on page 20 describes the protocol-specific parameters for the MQ protocol: 19