In Juniper Secure Analytics (JSA), incoming log data, such as syslog messages from an SRX Series firewall, are processed as events. The requirement is to create a rule that analyzes these specific log messages. An event rule is the JSA component designed specifically to test and evaluate conditions based on event data. This rule type can be configured to count specific events (like firewall denies) over a period, and if a defined threshold is exceeded, it can trigger a response action, such as sending an SNMP trap.

A. common: A common rule tests for conditions applicable to both event and flow data (e.g., IP address). An event rule is more specific and precise for analyzing syslog content.

B. offense: An offense is the result or outcome of a rule being triggered. It is an aggregation of related security incidents, not the rule type itself.

C. flow: A flow rule is used to analyze network flow data (e.g., NetFlow, J-Flow), which represents network session information, not log or syslog messages.

1. Juniper Secure Analytics

User Guide (Version 7.5.0)

Chapter: "Rules"

Section: "Rules Overview". This section states

"JSA includes two types of rules: event rules and flow rules. Event rules are applied to events. Flow rules are applied to flows." It clarifies that events are derived from sources like log files and syslog. (Document available via Juniper TechLibrary).

2. Juniper Secure Analytics

Administration Guide (Version 7.5.0)

Chapter: "Event and Flow Data"

Section: "Event and flow pipeline". This chapter details how JSA ingests and processes different data types

distinguishing between event data (logs

syslog

SNMP) and flow data (NetFlow

J-Flow

sFlow)

reinforcing that a rule for syslog must be an event rule. (Document available via Juniper TechLibrary).

3. Juniper Secure Analytics

User Guide (Version 7.5.0)

Chapter: "Rules"

Section: "Rule responses". This section lists "Send SNMP Trap" as a possible response action that can be configured for a rule

confirming the action described in the question is a standard rule response. (Document available via Juniper TechLibrary).