Cloud Feeds for Juniper ATP Cloud

date_range 13-Dec-24

arrow_backward

arrow_forward

The cloud feed URL is set up automatically for you when your SRX Series Firewall is enrolled to the Juniper ATP Cloud. For more information, see Enroll an SRX Series Firewall Using the CLI and Enroll an SRX Series Firewall Using Juniper ATP Cloud Web Portal. There are no further steps you need to do to configure the cloud feed URL.

If you want to check the cloud feed URL on your SRX Series Firewall, run the show services security-intelligence URL CLI command. Your output should look similar to the following:

content_copy zoom_out_map
root@host# show services security-intelligence url
https://cloudfeeds.sky.junipersecurity.net/api/manifest.xml

If you do not see a URL listed, run the ops script again as it configures other settings in addition to the cloud feed URL.

Once you configure your SRX Series Firewall, the cloud feeds are automatically sent from Juniper ATP Cloud to the device.

SRX Series Update Intervals for Cloud Feeds

The following table provides the update intervals for each feed type. Note that when the SRX Series Firewall makes requests for new and updated feed content, if there is no new content, no updates are downloaded at that time.

Note:

Run the following commands only for troubleshooting purposes:

The request services security-intelligence uninstall command uninstalls the SecIntel service from the device.
The request services security-intelligence download command is used to manually initiate the download of the latest SecIntel updates before the next interval.

Table 1: Feed Update Intervals
Category	Feeds	SRX Series Firewall Update Intervals (in Seconds)
Command and Control (C&C)	Juniper Feeds	1,800
	Integrated Feeds	86,400
	Customer Feeds	60
GeoIP	geoip_country	86,400
Allowlist	Juniper Feeds (whitelist_dns)	1,800
	Juniper Feeds (whitelist_dns_umbrella)	86,400
	Customer Feeds (domain, IP and Domain Name System (DNS))	1,800
	Customer Feeds (reverse shell)	300
Blocklist	Customer Feeds (domain and IP)	1800
Infected Hosts	Infected Hosts	60
Suspicious Hosts	Suspicious Hosts	60
DNS	Juniper Feeds	1800
DNS	Customer Feeds	60
Dynamic Address Group (DAG)	Customer Feeds	1,800
Dynamic Address Group (DAG)	Third party DAG Feeds. For example, Office 365	1,800

arrow_backward PREVIOUS Enroll an SRX Series Firewall Using the CLI

NEXT arrow_forward Juniper Advanced Threat Prevention Cloud Policy Overview

Juniper ATP Cloud Administrator Guide

Cloud Feeds for Juniper ATP Cloud

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry