Juniper monitoring

Question

A app for monitor Juniper logs srx, sa etc would be cool.

Answer 1

I already have some field extractions that I made for SRX

Created Session Logs

RT_FLOW_SESSION_CREATE:\ssession\screated\s(?P<srx_src_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_src_port>\d+)\D+(?P<srx_dst_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_dst_port>\d+)\s(?P<srx_svc_name>\S+)\s(?P<srx_nat_src_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_nat_src_port>\d+)\D+(?P<srx_nat_dst_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_nat_dst_port>\d+)\s(?P<srx_src_nat_rule_name>\S+)\s(?P<srx_dst_nat_rule_name>\S+)\s(?P<srx_protocol_id>\d+)\s(?P<srx_policy_name>\S+)\s(?P<srx_src_zone>\S+)\s(?P<srx_dst_zone>\S+)\s(?P<srx_sess_id>\d+)

Closed Session Logs

RT_FLOW_SESSION_CLOSE:\ssession\sclosed\s(?P<srx_closed_reason>[^:]+)\D+(?P<srx_src_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_src_port>\d+)\D+(?P<srx_dst_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_dst_port>\d+)\s(?P<srx_svc_name>\S+)\s(?P<srx_nat_src_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_nat_src_port>\d+)\D+(?P<srx_nat_dst_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_nat_dst_port>\d+)\s(?P<srx_src_nat_rule_name>\S+)\s(?P<srx_dst_nat_rule_name>\S+)\s(?P<srx_protocol_id>\d+)\s(?P<srx_policy_name>\S+)\s(?P<srx_src_zone>\S+)\s(?P<srx_dst_zone>\S+)\s(?P<srx_sess_id>\d+)\s(?P<srx_pkts_from_client>\d+)\((?P<srx_bytes_from_client>\d+)\)\s(?P<srx_pkts_from_server>\d+)\((?P<srx_bytes_from_server>\d+)\)\s(?P<srx_sess_elapsed_time>\d+)

Answer 2

0

Jerrad,

Any chance you have a field extraction for the IDS reporting on the SRX?

Here's a sample of the security log output:

Mar 14 09:43:50 Mar 14 09:43:50 RT_IDS: %USER-3-RT_SCREEN_TCP: Port scan! source: :80, destination: :27743, zone name: untrust, interface name: ae1.0

link

answered 14 Mar '11, 18:08

williamturner
11●1
accept rate: 0%

Answer 3

Never mind :)

I've been able to create these extractions myself.

EXTRACT-RT_SCREEN_ICMP

(?i)-RT_SCREEN_ICMP: (?P<ids_detection>.+?)s+w+:D+(?P<ids_src_ip>d+.d+.d+.d+),sdestination:D+(?P<ids_dest_ip>d+.d+.d+.d+),szonesname:s(?P<ids_zone>S+),sinterfacesname:s(?P<ids_interface>S+)

EXTRACT-RT_SCREEN_TCP

(?i)-RT_SCREEN_TCP: (?P<ids_detection>.+?)s+w+:D+(?P<ids_src_ip>d+.d+.d+.d+):(?P<ids_src_port>d+),sdestination:D+(?P<ids_dest_ip>d+.d+.d+.d+):(?P<ids_dest_port>d+),szonesname:s(?P<ids_zone>S+),sinterfacesname:s(?P<ids_interface>S+)

EXTRACT-RT_SCREEN_IP

(?i)-RT_SCREEN_IP: (?P<ids_detection>.+?)s+w+:D+(?P<ids_src_ip>d+.d+.d+.d+),sdestination:D+(?P<ids_dest_ip>d+.d+.d+.d+),sprotocol-id:s(?P<ids_protocol>d+),szonesname:s(?P<ids_zone>S+),sinterfacesname:s(?P<ids_interface>S+)

Hope this helps others.

Juniper monitoring

Follow this question

Splunk Resources

Related questions