| Table of Contents |
|---|
Overview
In this document we are guiding with the steps to ingest Juniper Firewall SRX series with Seceon SIEM to have a Comprehensive visibility and Proactive Threat Detection in your Environment.
Configuring to send Syslog Messages
...
Using J-Web
Log in to the Juniper SRX device.
Click Configure > CLI Tools > Point and Click CLI in the Juniper SRX device.
Expand System and click Syslog.
In the Syslog page, click Add New Entry placed next to 'Host'.
Enter the IP address of the remote Syslog server (CCE server IP) (i.e., Firewall Analyzer).
Click Apply to save the configuration.
...
Using CLI
Log in to the Juniper SRX device CLI console.
Execute the following command:
|
To enable logging for Security policy:
Using J-Web
Select Configure > Security > Policy > FW Policies.
Click on the policy for which you would like to enable logging.
Navigate to Logging/Count and in Log Options, select Log at Session Close Time.
...
Using CLI
Log in to the Juniper SRX device CLI console.
Execute the following command:
|
Juniper Networks IDP Device (version IDP 50)
Configuring to send Syslog Messages directly from Sensor
...
Profiler logs
Device connect/disconnect logs
Interface UP/DOWN logs
Logs for Bypass State Changes
Configuring to send Syslog Messages from
...
NSM
Log in to NSM.
Click Action Manager > Action Parameters > Define a Syslog Server in the NSM.
Click Action Manager > Device Log Action Criteria > Category in the NSM.
Select Category = all and Actions = syslog enable
Click Apply to save the changes.
...
Interface UP/DOWN logs
Logs for Bypass State Changes
...
Verification
STEP1: Login to UI >> SYSTEM>> LOGS AND FLOWS COLLECTION STATUS .
...
STEP 2: >> LOGS AND FLOWS COLLECTION STATUS .
...
STEP 3: >>Inside SOURCE DEVICE IP, IP will reflect.
...