Juniper monitoring

[fisk12]

A app for monitor Juniper logs srx, sa etc would be cool.

[williamturner]

Never mind 🙂

I've been able to create these extractions myself.

EXTRACT-RT_SCREEN_ICMP

(?i)-RT_SCREEN_ICMP: (?P.+?)\s+\w+:\D+(?P\d+.\d+.\d+.\d+)\,\sdestination:\D+(?P\d+.\d+.\d+.\d+)\,\szone\sname:\s(?P\S+)\,\sinterface\sname:\s(?P\S+)

EXTRACT-RT_SCREEN_TCP

(?i)-RT_SCREEN_TCP: (?P.+?)\s+\w+:\D+(?P\d+.\d+.\d+.\d+):(?P\d+)\,\sdestination:\D+(?P\d+.\d+.\d+.\d+):(?P\d+)\,\szone\sname:\s(?P\S+)\,\sinterface\sname:\s(?P\S+)

EXTRACT-RT_SCREEN_IP

(?i)-RT_SCREEN_IP: (?P.+?)\s+\w+:\D+(?P\d+.\d+.\d+.\d+)\,\sdestination:\D+(?P\d+.\d+.\d+.\d+)\,\sprotocol-id:\s(?P\d+)\,\szone\sname:\s(?P\S+)\,\sinterface\sname:\s(?P\S+)

Hope this helps others.

[williamturner]

Jerrad,

Any chance you have a field extraction for the IDS reporting on the SRX?

Here's a sample of the security log output:

Mar 14 09:43:50 Mar 14 09:43:50 RT_IDS: %USER-3-RT_SCREEN_TCP: Port scan! source: :80, destination: :27743, zone name: untrust, interface name: ae1.0

[jerrad]

I already have some field extractions that I made for SRX

Created Session Logs

RT_FLOW_SESSION_CREATE:\ssession\screated\s(?P<srx_src_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_src_port>\d+)\D+(?P<srx_dst_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_dst_port>\d+)\s(?P<srx_svc_name>\S+)\s(?P<srx_nat_src_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_nat_src_port>\d+)\D+(?P<srx_nat_dst_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_nat_dst_port>\d+)\s(?P<srx_src_nat_rule_name>\S+)\s(?P<srx_dst_nat_rule_name>\S+)\s(?P<srx_protocol_id>\d+)\s(?P<srx_policy_name>\S+)\s(?P<srx_src_zone>\S+)\s(?P<srx_dst_zone>\S+)\s(?P<srx_sess_id>\d+) 

Closed Session Logs

RT_FLOW_SESSION_CLOSE:\ssession\sclosed\s(?P<srx_closed_reason>[^:]+)\D+(?P<srx_src_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_src_port>\d+)\D+(?P<srx_dst_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_dst_port>\d+)\s(?P<srx_svc_name>\S+)\s(?P<srx_nat_src_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_nat_src_port>\d+)\D+(?P<srx_nat_dst_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_nat_dst_port>\d+)\s(?P<srx_src_nat_rule_name>\S+)\s(?P<srx_dst_nat_rule_name>\S+)\s(?P<srx_protocol_id>\d+)\s(?P<srx_policy_name>\S+)\s(?P<srx_src_zone>\S+)\s(?P<srx_dst_zone>\S+)\s(?P<srx_sess_id>\d+)\s(?P<srx_pkts_from_client>\d+)\((?P<srx_bytes_from_client>\d+)\)\s(?P<srx_pkts_from_server>\d+)\((?P<srx_bytes_from_server>\d+)\)\s(?P<srx_sess_elapsed_time>\d+)