Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Expand All close

Expand All close

Contrail Service Orchestration User Guide

play_arrow Administration Portal
- play_arrow Introduction
  - Unified Administration and Customer Portal Overview
  - Administration Portal Overview
  - Logging in to Administration Portal
  - Switching the Tenant Scope
  - Changing the Administration Portal Password
  - Changing the Password on First Login
  - Resetting the Password
  - Setting Password Duration
  - Extending the User Login Session
  - Setting Up the Cloud CPE Centralized Deployment Model with Administration Portal
  - Setting Up the Cloud CPE Distributed Deployment Model with Administration Portal
- play_arrow Managing Objects
  - Creating Objects
  - Modifying an Object
  - Deleting Objects
  - Viewing Object Details
  - Searching for Text in an Object Data Table
  - Sorting Objects
- play_arrow Using the Dashboard
  - About the Administration Portal Dashboard
- play_arrow Monitoring Alerts, Alarms, and Device Events
  - About the Monitor Overview Page
  - Alerts Overview
  - About the Generated Alerts Page
  - About the Alert Definitions Page
  - Creating SD-WAN Alert Definitions
  - Editing and Deleting SD-WAN Alert Definitions
  - About the Alarms Page
  - About the Device Events Page
- play_arrow Monitoring Tenants SLA Performance
  - Multidepartment CPE Device Support
  - About the SLA Performance of All Tenants Page
  - About the SLA Performance of a Single Tenant Page
  - Monitoring Application-Level SLA Performance for real time-optimized SD-WAN
  - Viewing the SLA Performance of a Site
  - Viewing the SLA Performance of an Application or Application Group
  - Understanding SLA Performance Score for Applications, Links, Sites, and Tenants
- play_arrow Monitoring Jobs
  - About the Jobs Page
  - Viewing Job Details
  - Editing and Deleting Scheduled Jobs
  - Retrying a Failed Job on Devices
- play_arrow Managing POPs
  - About the POPs Page
  - Creating a Single POP
  - Importing Data for Multiple POPs
  - Viewing the History of POP Data Imports
  - Viewing the History of POP Data Deletions
  - Managing a Single POP
  - About the VIMs Page
  - Creating a Cloud VIM
  - About the EMS Page
  - Creating an EMS
  - Changing the Junos Space Virtual Appliance Password
  - About the Routers Page
  - Creating Devices
  - Configuring Devices
  - View the History of Device Data Deletions
- play_arrow Managing Devices
  - About the Tenant Devices Page
  - About the Cloud Hub Devices Page
  - Managing a Tenant Device
  - Managing a Cloud Hub Device
  - Device Redundancy Support Overview
  - Viewing the History of Tenant Device Activation Logs
  - Viewing the History of Cloud Hub Device Activation Logs
  - Secure OAM Network Overview
  - Adding a Cloud Hub Device
  - Upgrading a Cloud Hub Device
  - Rebooting a CPE Device
- play_arrow Managing Device Templates
  - Device Template Overview
  - About the Device Template Page
  - Cloning a Device Template
  - Importing a Device Template
  - Configuring a Device Template
  - Modifying a Device Template Description
  - Deleting a Device Template
- play_arrow Managing Software Images
  - Device Images Overview
  - About the Device Images Page
  - Deploying Device Images to Devices
  - Uploading a Device Image
  - Deleting Device Images
- play_arrow Configuring Network Services in a Centralized Deployment
  - Network Services Overview
  - About the Network Services Page
  - About the Service Overview Page
  - About the Service Instances Page
  - Configuring VNF Properties
  - Allocating a Service to Tenants
  - Removing a Service from Tenants
  - Viewing a Service Configuration
  - vSRX VNF Configuration Settings
  - LxCIPtable VNF Configuration Settings
  - Cisco CSR-1000v VNF Configuration Settings
  - Riverbed Steelhead VNF Configuration Settings
  - Managing a Single Service
- play_arrow Configuring Application SLA Profiles
  - Application Quality of Experience (AppQoE) Overview
  - About the Application Traffic Type Profiles Page
  - Creating Traffic Type Profiles
  - Editing and Deleting Traffic Type Profiles
  - SLA Profiles and SD-WAN Policies Overview
  - Cost-Based Link Switching
  - Local Breakout Overview
  - About the Application SLA Profiles Page
  - Creating SLA Profiles
  - Editing and Deleting SLA Profiles
- play_arrow Configuring Application Signatures
  - Application Signatures Overview
  - About the Application Signatures Page
  - Creating Application Signature Groups
  - Editing, Cloning, and Deleting Application Signature Groups
- play_arrow Managing Tenants
  - Tenant Overview
  - Full Mesh Topology Overview
  - About the Tenants Page
  - Adding a Single Tenant
  - Editing Tenant Information
  - Importing Data for Multiple Tenants
  - Allocating Network Services to a Tenant
  - Viewing the History of Imported Tenant Data
  - Viewing the History of Deleted Tenant Data
- play_arrow Managing Operating Companies
  - Operating Companies Overview
  - About the Operating Companies Page
  - Creating Operating Companies
  - Editing and Deleting Operating Companies
- play_arrow Configuring SP Users
  - Role-Based Access Control Overview
  - About the Service Provider Users Page
  - Adding Service Provider Users
  - Editing and Deleting Service Provider Users
  - Resetting the Password for Service Provider and Tenant Users
- play_arrow Managing Audit Logs
  - Audit Logs Overview
  - About the Audit Logs Page
  - Viewing the Details of an Audit Log
  - Exporting Audit Logs
- play_arrow Managing Roles
  - Roles Overview
  - About the Roles Page
  - Adding User-Defined Roles for Service Provider, OpCo, and Tenant Users
  - Editing, Cloning, and Deleting User-Defined Roles for Service Provider, OpCo, and Tenant Users
  - Access Privileges for Role Scopes (Service Provider, Tenant, and Operating Company)
- play_arrow Configuring Authentication
  - Authentication Methods Overview
  - About the Authentication Page
  - Editing the Authentication Method
  - Configuring a Single Sign-On Server
  - Editing and Deleting SSO Servers
  - Configuring SMTP Settings
- play_arrow Configuring Licenses
  - About the License Files Page
  - Uploading a License File
  - Editing and Deleting Licenses
  - Pushing a License to Devices
- play_arrow Customizing the Unified Portal
  - Personalizing the Unified Administration and Customer Portal
- play_arrow Managing Signature Database
  - Signature Database Overview
  - About the Active Database Page
  - Downloading a Signature Database
  - Download Locations for Signature Database
  - Installing Signatures
play_arrow Customer Portal
- play_arrow Introduction
  - Unified Administration and Customer Portal Overview
  - Customer Portal Overview
  - Switching the Tenant Scope
  - Accessing Customer Portal
  - Setting Up Your Network with Customer Portal
  - Changing the Password on First Login
  - Changing the Customer Portal Password
  - Resetting the Password
  - Extending the User Login Session
- play_arrow Using the Dashboard
  - About the Customer Portal Dashboard
- play_arrow Managing Objects
  - Sorting Objects
  - Viewing Object Details
  - Searching for Text in an Object Data Table
- play_arrow Monitoring Security Alerts and Alarms
  - About the Monitor Overview Page
  - Alerts Overview
  - About the Generated Alerts Page
  - About the Alert Definitions Page
  - Managing Security Alerts Definitions
  - Creating Security Alert Definitions
  - Editing, Cloning, and Deleting Security Alert Definitions
  - About the Alarms Page
- play_arrow Monitoring Security and Device Events
  - About the All Security Events Page
  - About the Firewall Events Page
  - About the Web Filtering Events Page
  - About the IPsec VPNs Events Page
  - About the Content Filtering Events Page
  - About the Antispam Events Page
  - About the Antivirus Events Page
  - About the IPS Events Page
  - About the Device Events Page
  - About the Screen Events Page
- play_arrow Monitoring SD-WAN Events
  - SD-WAN Events Overview
  - About the SD-WAN Events Page
- play_arrow Monitoring Applications
  - About the SLA Performance of a Single Tenant Page
  - Viewing the SLA Performance of a Site
  - Viewing the SLA Performance of an Application or Application Group
  - Application Visibility Overview
  - About the Application Visibility Page
  - Selecting Devices
- play_arrow Monitoring Threats
  - About the Threats Map (Live) Page
- play_arrow Monitoring Jobs
  - About the Jobs Page
  - Editing and Deleting Scheduled Jobs
  - Viewing Job Details
  - Retrying a Failed Job on Devices
- play_arrow Managing Devices
  - Multidepartment CPE Device Support
  - About the Devices Page
  - Performing Return Material Authorization (RMA) for a Single-CPE Device
  - Performing Return Material Authorization (RMA) for Dual-CPE Devices
  - Granting RMA for a Device
  - Managing a Single CPE Device
  - Rebooting a CPE Device
- play_arrow Managing Device Images
  - Device Images Overview
  - About the Device Images Page
  - Deleting Device Images
- play_arrow Configuring Network Services in a Distributed Deployment
  - Network Service Overview
  - About the Network Services Page
  - About the Service Overview Page
  - About the Service Instances Page
  - Configuring VNF Properties
  - vSRX VNF Configuration Settings
  - LxCIPtable VNF Configuration Settings
  - Cisco CSR-1000v VNF Configuration Settings
  - Riverbed Steelhead VNF Configuration Settings
- play_arrow Managing Firewall Policies
  - Firewall Policy Overview
  - About the Firewall Policy Page
  - Creating Firewall Policy Intents
  - Editing, Cloning, and Deleting Firewall Policy Intents
  - Selecting Firewall Source
  - Selecting Firewall Destination
  - Firewall Policy Examples
  - Firewall Policy Schedules Overview
  - About the Firewall Policy Schedules Page
  - Creating Schedules
  - Editing, Cloning, and Deleting Schedules
- play_arrow Unified Threat Management
  - UTM Overview
  - Configuring UTM Settings
  - About the UTM Profiles Page
  - Creating UTM Profiles
  - Editing, Cloning, and Deleting UTM Profiles
  - About the Web Filtering Profiles Page
  - Creating Web Filtering Profiles
  - Editing, Cloning, and Deleting Web Filtering Profiles
  - About the Antivirus Profiles Page
  - Creating Antivirus Profiles
  - Editing, Cloning, and Deleting Antivirus Profiles
  - About the Antispam Profiles Page
  - Creating Antispam Profiles
  - Editing, Cloning, and Deleting Antispam Profiles
  - About the Content Filtering Profiles Page
  - Creating Content Filtering Profiles
  - Editing, Cloning, and Deleting Content Filtering Profiles
  - About the URL Patterns Page
  - Creating URL Patterns
  - Editing, Cloning, and Deleting URL Patterns
  - About the URL Categories Page
  - Creating URL Categories
  - Editing, Cloning, and Deleting URL Categories
- play_arrow Managing SD-WAN
  - SLA Profiles and SD-WAN Policies Overview
  - About the SD-WAN Policy Page
  - Creating SD-WAN Policy Intents
  - Editing and Deleting SD-WAN Policy Intents
  - About the Application SLA Profiles Page
  - Creating SLA Profiles
  - Editing and Deleting SLA Profiles
- play_arrow Managing NAT Policies
  - NAT Policies Overview
  - About the NAT Policies Page
  - Creating NAT Policies
  - Editing and Deleting NAT Policies
  - About the Single NAT Policy Page
  - Creating NAT Policy Rules
  - Editing, Cloning, and Deleting NAT Policy Rules
  - Deploying NAT Policy Rules
  - Selecting NAT Source
  - Selecting NAT Destination
  - NAT Pools Overview
  - About the NAT Pools Page
  - Creating NAT Pools
  - Editing, Cloning, and Deleting NAT Pools
- play_arrow Managing SSL Proxies
  - SSL Forward Proxy Overview
  - About the SSL Proxy Policy Page
  - Creating SSL Proxy Policy Intents
  - Editing, Cloning, and Deleting SSL Proxy Policy Intents
  - Understanding How SSL Proxy Policy Intents Are Applied
  - About the SSL Proxy Profiles Page
  - Creating SSL Forward Proxy Profiles
  - Editing, Cloning, and Deleting SSL Forward Proxy Profiles
  - Configuring and Deploying an SSL Forward Proxy Policy
- play_arrow Managing Shared Objects
  - Addresses and Address Groups Overview
  - About the Addresses Page
  - Creating Addresses or Address Groups
  - Editing, Cloning, and Deleting Addresses and Address Groups
  - Services and Service Groups Overview
  - About the Services Page
  - Creating Services and Service Groups
  - Creating Protocols
  - Editing and Deleting Protocols
  - Editing, Cloning, and Deleting Services and Service Groups
  - Application Signatures Overview
  - About the Application Signatures Page
  - Creating Application Signature Groups
  - Editing, Cloning, and Deleting Application Signature Groups
  - About the Departments Page
  - Creating a Department
  - Modifying a Department
  - Deleting a Department
- play_arrow Managing Deployments
  - Deploying Policies Overview
  - About the Deployments Page
  - Using the Deployment Icon to Deploy Policies
  - Deploying Policies
- play_arrow Managing Sites
  - About the Sites Page
  - Local Breakout Overview
  - Multihoming Overview
  - Device Redundancy Support Overview
  - Upgrading Sites Overview
  - Creating Spoke Sites for Hybrid WAN Deployment
  - Creating Local Service Edge Sites for Hybrid WAN Deployment
  - Creating Regional Service Edge Sites for Hybrid WAN Deployment
  - Creating On-Premise Hub Sites for SD-WAN Deployment
  - Creating On-Premise Spoke Sites for SD-WAN Deployment
  - Creating Cloud Hub Sites for SD-WAN Deployment
  - Creating Cloud Spoke Sites for SD-WAN Deployment
  - Provisioning a Cloud Spoke Site in AWS VPC
  - Importing Multiple Sites
  - Managing a Single Site
  - Configuring a Single Site
  - Upgrading Sites
  - Managing LAN Segments on a Tenant Site
  - Activating a CPE Device
  - Activating Dual CPE Devices (Device Redundancy)
  - Viewing the History of Tenant Device Activation Logs
  - Configuring VRFs and PNE Details for a Site in a Centralized Deployment
- play_arrow Managing Site Groups
  - About the Site Groups Page
  - Creating Site Groups
- play_arrow Security Reports
  - Reports Overview
  - About the Security Report Definitions Page
  - Performing Different Actions on Reports
  - About the Security Generated Reports Page
  - Creating Log Report Definition
  - Creating Bandwidth Report Definition
  - Editing and Deleting Log Report Definitions
  - Editing and Deleting Bandwidth Report Definitions
- play_arrow SD-WAN Reports
  - About the SD-WAN Report Definitions Page
  - Editing and Deleting SD-WAN Report Definitions
  - Creating SD-WAN Tenant Performance Report Definition
  - Creating SD-WAN Site Performance Report Definition
  - About the SD-WAN Generated Reports Page
- play_arrow Managing Tenant Users
  - Role-Based Access Control Overview
  - About the Tenant Users Page
  - Adding Tenant Users
  - Editing and Deleting Tenant Users
  - Resetting the Password for Tenant Users
- play_arrow Managing Audit Logs
  - Audit Logs Overview
  - About the Audit Logs Page
  - Viewing the Details of an Audit Log
  - Exporting Audit Logs
- play_arrow Managing Tenant User Roles
  - Roles Overview
  - About the Tenant Roles Page
  - Adding User-Defined Roles for Tenant Users
  - Editing, Cloning, and Deleting User-Defined Roles for Tenant Users
  - Access Privileges for Role Scopes (Service Provider, Tenant, and Operating Company)
- play_arrow Licenses
  - About the Licenses Page
- play_arrow Signature Database
  - Signature Database Overview
  - About the Active Database Page
  - Installing Signatures
- play_arrow Managing Certificates
  - Certificates Overview
  - About the Certificates Page
  - Importing a Certificate
  - Installing and Uninstalling Certificates
  - About the VPN Authentication Page
- play_arrow Managing Juniper Identity Management Service
  - Juniper Identity Management Service Overview
  - About the Identity Management Page
  - Configuring CSO and JIMS Connection
  - Configuring JIMS for an SRX Device
play_arrow Designer Tools
play_arrow Downloads
- Download this guide: User Guide

list Table of Contents

English

Creating Security Alert Definitions

date_range 20-Jun-18

arrow_backward

arrow_forward

You can create an alert definition to monitor your data in real time. You can identify issues and attacks before they impact your network.

For example, if you are an administrator, you can define a condition such that if the number of firewall deny events crosses a predefined threshold in a given time frame for a specific device, you receive an e-mail alert.

To create a security alert definition:

Select Monitor > Alerts & Alarms > Alert Definitions > Security.
The Security alert definitions page appears.
Click the create icon (+) or add icon (+).
The Create an Alert Definition page appears.
Complete the configuration according to the guidelines provided in Table 1.
Click OK. If you want to discard the changes, click Cancel instead.

A new alert definition with the configured alert triggering condition is created. You can view the generated alerts from the alert definition to troubleshoot the issues with your system.

Table 1: Fields on the Security Alert Definitions Page

Field	Description
General
Alert Name	Enter a unique string of alphanumeric characters, colons, periods, dashes, and underscores. No spaces are allowed and the maximum length is 63 characters.
Alert Description	Enter a description for the alerts; maximum length is 1024 characters.
Alert Type	Displays the type of alert that is system-based.
Status	Select the Active check box to view only the active alerts.
Severity	Select the severity level of the alert: info, minor, major, critical.
Trigger
Use Data Criteria from Filters	Specifies the data criteria from the list of default and user-created filters that are saved from the Event Viewer. To add saved filters: Click the Use data criteria from filters link. The Add Saved Filters page appears. Select the filters to be added. Click OK.
Add Data Criteria	Specifies the data criteria based on the Time Span period, Group By, and Filter By option. Filtered data only displays the subset of data that meets the criteria that you specify.
Recipient(s)
E-mail Address(es)	Specify the e-mail addresses for the recipients of the alert notification.
Custom Message	Enter a custom string for identifying the type of alert in the alert notification e-mail.

Related Documentation

arrow_backward PREVIOUS Managing Security Alerts Definitions

NEXT arrow_forward Editing, Cloning, and Deleting Security Alert Definitions

footer-navigation