March, 2021 Release

Server Message Block (SMB) protocol support for file inspection

Starting in Junos OS Release 21.1R1, SRX Series Firewalls support the Server Message Block (SMB) protocol in advanced anti-malware (AAMW) file inspection. Users and applications can use the SMB protocol to access files and other resources on a remote server. Navigate to Monitor > File Scanning > SMB File Downloads in the Juniper ATP Cloud UI to view the list of files downloaded by hosts for SMB protocol inspection.

[See SMB File Download Overview, SMB File Download Details, advanced-anti-malware policy, and show services advanced-anti-malware statistics.]

Support for username feed type in adaptive threat profiling feeds

Starting in Junos OS Release 21.1R1, you can add user the source identity (username) feed type to adaptive threat profiling feeds. Navigate to Configure > Threat Profiling in the Juniper ATP Cloud UI to configure adaptive threat profiling feed.

[See Adaptive Threat Profiling Overview and Configuration, Create an Adaptive Threat Profiling Feed, security-intelligence (security policies), and show services security-intelligence.]

Audit logs

You can now view audit logs for login activity and specific tasks that are completed successfully using the ATP Cloud Web portal. Audit log entries include details about user-initiated tasks, such as the username, task name, task details, and date and time of execution of the task. You can view audit logs for a specific time span, search for and filter for audit logs, and export audit logs in comma-separated values (CSV) format. The retention period for audit logs is five years.

[See View Audit Logs.]

Virtual routing and forwarding (VRF) behavior for adaptive threat profiling feeds

In earlier releases, malware and CC submissions from all VRF instances under root logical domain were accepted even though they were not associated with the sub-realm. From this release onwards, you can see similar behavioral change for adaptive threat profiling feeds as well. Feeds from SRX Series Firewalls are accepted for all VRF instances under the root logical domain even though they are not associated with any sub-realm.