- play_arrow Administration Portal
- play_arrow Introduction
- Unified Administration and Customer Portal Overview
- Administration Portal Overview
- Logging in to Administration Portal
- Switching the Tenant Scope
- Changing the Administration Portal Password
- Changing the Password on First Login
- Resetting the Password
- Setting Password Duration
- Extending the User Login Session
- Setting Up the Cloud CPE Centralized Deployment Model with Administration Portal
- Setting Up the Cloud CPE Distributed Deployment Model with Administration Portal
- play_arrow Managing Objects
- play_arrow Using the Dashboard
- play_arrow Monitoring Alerts, Alarms, and Device Events
- play_arrow Monitoring Tenants SLA Performance
- Multidepartment CPE Device Support
- About the SLA Performance of All Tenants Page
- About the SLA Performance of a Single Tenant Page
- Monitoring Application-Level SLA Performance for real time-optimized SD-WAN
- Viewing the SLA Performance of a Site
- Viewing the SLA Performance of an Application or Application Group
- Understanding SLA Performance Score for Applications, Links, Sites, and Tenants
- play_arrow Monitoring Jobs
- play_arrow Managing POPs
- About the POPs Page
- Creating a Single POP
- Importing Data for Multiple POPs
- Viewing the History of POP Data Imports
- Viewing the History of POP Data Deletions
- Managing a Single POP
- About the VIMs Page
- Creating a Cloud VIM
- About the EMS Page
- Creating an EMS
- Changing the Junos Space Virtual Appliance Password
- About the Routers Page
- Creating Devices
- Configuring Devices
- View the History of Device Data Deletions
- play_arrow Managing Devices
- About the Tenant Devices Page
- About the Cloud Hub Devices Page
- Managing a Tenant Device
- Managing a Cloud Hub Device
- Device Redundancy Support Overview
- Viewing the History of Tenant Device Activation Logs
- Viewing the History of Cloud Hub Device Activation Logs
- Secure OAM Network Overview
- Adding a Cloud Hub Device
- Upgrading a Cloud Hub Device
- Rebooting a CPE Device
- play_arrow Managing Device Templates
- play_arrow Managing Software Images
- play_arrow Configuring Network Services in a Centralized Deployment
- Network Services Overview
- About the Network Services Page
- About the Service Overview Page
- About the Service Instances Page
- Configuring VNF Properties
- Allocating a Service to Tenants
- Removing a Service from Tenants
- Viewing a Service Configuration
- vSRX VNF Configuration Settings
- LxCIPtable VNF Configuration Settings
- Cisco CSR-1000v VNF Configuration Settings
- Riverbed Steelhead VNF Configuration Settings
- Managing a Single Service
- play_arrow Configuring Application SLA Profiles
- Application Quality of Experience (AppQoE) Overview
- About the Application Traffic Type Profiles Page
- Creating Traffic Type Profiles
- Editing and Deleting Traffic Type Profiles
- SLA Profiles and SD-WAN Policies Overview
- Cost-Based Link Switching
- Local Breakout Overview
- About the Application SLA Profiles Page
- Creating SLA Profiles
- Editing and Deleting SLA Profiles
- play_arrow Configuring Application Signatures
- play_arrow Managing Tenants
- play_arrow Managing Operating Companies
- play_arrow Configuring SP Users
- play_arrow Managing Audit Logs
- play_arrow Managing Roles
- play_arrow Configuring Authentication
- play_arrow Configuring Licenses
- play_arrow Customizing the Unified Portal
- play_arrow Managing Signature Database
-
- play_arrow Designer Tools
- play_arrow Configuration Designer
- Configuration Designer Overview
- Accessing the Configuration Designer
- Using the Configuration Designer
- Changing Your Password
- About the Requests Page for the Configuration Designer
- Creating Requests for Configuration Templates
- Designing Templates with a YANG Configuration
- Designing Templates with a Configuration
- Publishing Configuration Templates
- About the Designs Page for the Configuration Designer
- Cloning Configuration Templates
- Deleting Configuration Template Designs
- play_arrow Resource Designer
- Resource Designer Overview
- Using the Resource Designer
- Accessing the Resource Designer
- About the Requests Page for the Resource Designer
- VNF Overview
- Creating Requests for VNF Packages
- Designing VNF Packages
- Adding VNF Managers
- Publishing VNF Packages
- About the Designs Page for the Resource Designer
- Cloning VNF Packages
- Importing VNF Packages
- Exporting VNF Packages
- Deleting VNF Packages
- play_arrow Network Service Designer introduction
- play_arrow Creating Requests for Network Services
- play_arrow Creating Network Services
- About the Build Page for the Network Service Designer
- Viewing Information About VNFs
- Designing Network Services
- Connecting VNFs in a Service Chain
- Defining Ingress and Egress Points for a Service Chain
- Monitoring Performance Goals
- Configuring Network Services
- vSRX Configuration Settings
- LxCIPtable VNF Configuration Settings
- Cisco CSR-1000v VNF Configuration Settings
- Riverbed Steelhead VNF Configuration Settings
- Fortinet VNF Configuration Settings
- Ubuntu VNF Configuration Settings
- play_arrow Managing Network Services
-
- play_arrow Downloads
About the Screen Events Page
To access this page, click Monitor > Security Events > Screen.
Use this page to view information about screen events that occur as a result of the screen options configured on SRX Series or vSRX security devices. Screen options are a detection and defense mechanism configured to filter the connection attempts bound towards a security zone. Screen options are used to prevent attacks, such as IP address sweeps, port scans, denial of service (DOS) attacks, Internet Control Message Protocol (ICMP), UDP, and SYN (Synchronize) floods.
You can view information related to screen events, including ICMP screening, IP screening, TCP screening, and UDP screening.
Using the time-range slider, you can quickly focus on the time and area of activity that you are most interested in. Once the time range is selected, all of the data presented in your view is refreshed automatically. You can also use the Custom button to set a custom time range.
There are two ways to view your data. You can select either the Summary View tab or the Detail View tab.
Tasks You Can Perform
You can perform the following tasks from this page:
View a brief summary of all the screen events in your network. See Summary View.
View the comprehensive details of events in a tabular format that includes sortable columns. See Detail View.
Summary View
The top of the page has a swim lane graph of all the screen events. You can use the widgets at the bottom of the page to view critical information such as, top sources, top source countries, top destinations, and top destination countries.
Table 1 describes the widgets on the Detail View page.
Table 1: Widgets on the Summary Page
Field | Description |
|---|---|
Top Sources | Top five source IP addresses with highest network traffic. |
Top Destinations | Top five destination IP addresses with highest network traffic. |
Top Source Countries | Top five countries from which the traffic that triggered the highest number of events originated and the number of events per country. |
Top Destination Countries | Top five countries to which the traffic that triggered the highest number events was sent and the number of events per country. |
Detail View
You can group the events using the Group By option. For example, you can group the events based on source country. The table includes information such as the event name, UTM category, source IP address, source country, and so on.
Table 2 describes the fields on the Detail View page.
Table 2: Fields on the Detail View Page
Fields | Description |
|---|---|
Log Generated Time | Time when the event occurred. |
Log Received Time | Time the log was received at the log collector. |
Site | Name of the tenant site from which the event originated. |
Event Name | Name of the device event in the log. |
Source Country | Country from which the traffic that triggered the event originated. |
Source IP | Source IP address for the traffic that triggered the event (IPv4 or IPv6). |
Destination Country | Country to which the traffic that triggered the event was sent. |
Destination IP | Destination IP address for the traffic that triggered the event (IPv4 or IPv6). |
Source Port | Source TCP/UDP port number of the traffic that triggered the event. |
Destination Port | Destination TCP/UDP port number of the traffic that triggered the event. |
Attack Name | Name of the attack in the log for threat event. For example, trojan, worm, virus, and so on. |
Description | Brief description of the event. |
Threat Severity | Level of severity of the threat. For example, minor, major, critical, and so on. |
Policy Name | Name of the policy which generates the log. The policy is configured on the SRX Series or vSRX device. |
Virus Name | This field is not applicable for screen events. |
URL | Accessed URL that triggered the event. |
Event Category | Event category in the log. For example, screen. |
User Name | User name identified by the SRX Series or vSRX device, if user identity is enabled on the device. |
Argument | Type of traffic. For example, FTP and HTTP. |
Action | Action taken for the event. For example, warning, allow, and block. |
Log Source | IP address of the device where the log is received (IPv4 or IPv6). |
Application | Name of the application associated with the traffic that triggered the event. |
Host Name | Hostname of the device where the log was generated. |
Service Name | Name of the application service used for the traffic that triggered the event. For example, FTP, HTTP, SSH, and so on. |
Nested Application | Nested application associated with the traffic that triggered the event. |
Source Zone | Source security zone of the traffic that triggered the event. |
Destination Zone | Destination security zone of the traffic that triggered the event. |
Protocol ID | Protocol ID of the traffic that triggered the event. |
Roles | Roles of the user as defined in the Active Directory, if available. |
Reason | Reason for the log generation. For example, unrestricted access. |
NAT Source Port | Translated source port. |
NAT Destination Port | Translated destination port. |
NAT Source Rule Name | NAT source rule name configured on the SRX Series or vSRX device. |
NAT Destination Rule Name | NAT destination rule name configured on the SRX Series or vSRX device. |
NAT Source IP | Translated source IP address for the traffic that triggered the event (IPv4 or IPv6). |
NAT Destination IP | Translated destination IP address for the traffic that triggered the event (IPv4 or IPv6). |
Traffic Session ID | Traffic session ID of the log. |
Path Name | This field is not applicable for screen events. |
Logical System Name | Name of the logical system which received the log. |
Rule Name | Name of the rule which generates the log. This rule is configured on the SRX Series or vSRX device. |
Profile Name | Name of the profile which filters the traffic that triggered the event. |
Client Host Name | Hostname of the client associated with the traffic that triggered the event. For example, if a specific computer is infected, the name of that computer is displayed. |
Malware info | Information about the malware causing the event. |
