SecIntel Feeds Overview and Benefits

SecIntel provides carefully curated and verified threat intelligence from Juniper Networks’ Advanced Threat Prevention (ATP) Cloud, Juniper Threat Labs, Dynamic Address Group (DAG), and industry-leading threat feeds to MX Series routers, SRX Series Firewalls, and NFX Series Network Services Platform to block Command and Control(C&C) communications at line rate. SecIntel delivers real-time threat intelligence by enabling automatic and responsive traffic filtering.

SecIntel integrates with EX Series and QFX Series switches and enables these switches to subscribe to SecIntel’s infected host feed. This enables you to block compromised hosts at the switch port. You can now extend SecIntel throughout your entire network and increase the number of security enforcement points.

Benefits of SecIntel Feeds

You can view all the default feeds that are available with your current license.

Using this page, you can enable the following feeds for integration with Juniper ATP Cloud.

• Juniper threat feeds

• Third party threat feeds—IP threat feeds and URL threat feeds.

• Dynamic address group feeds—Juniper DAG feeds and Third-party DAG feeds.

Note:

The expiry of the SecIntel feeds depends upon the time-to-live (TTL) value, which is different for each feed.

Note:

The total number of CC feeds are 32, out of which four feeds are reserved for cc_ip, cc_url, cc_ipv6, and cc_cert_sha1. So, you can enable up to 28 feeds to the CC category, which includes CC custom feeds and CC third-party feeds. This limit is applicable if you are injecting additional feeds using the available open API.

Information to know if you are enabling external feeds:

• If a hit is detected on an enabled external feed, this event appears under Monitor > Threat Sources with a threat level of 10.

• On enrolled SRX Series Firewalls, you can configure policies with the permit or block action for each feed. Note that C&C and Infected Host feeds require an enabled Security Intelligence policy on the SRX Series Firewall in order to work.

• External feeds are updated once every 24 hours.

Warning:

Understand that these are open source feeds managed by third parties and determining the accuracy of the feed is left up to the Juniper ATP Cloud administrator. Juniper will not investigate false positives generated by these feeds.

Warning:

Configured SRX Series policies will block malicious IP addresses based on enabled third party feeds, but these events do not affect host threat scores. Only events from Juniper ATP Cloud feeds affect host threat scores.

To enable the available feeds, do the following:

1. Navigate to Configure > Feeds Configuration > SecIntel Feeds.

2. For each feed, select the toggle button to enable the feed. Refer to the guidelines in Table 1.

   Note:

   The Infected Host feed is enabled for all license tiers. All other Juniper SecIntel feeds are enabled only with an advanced license.

   Click the Go to feed site link to view feed information, including the contents of the feed.

   Table 1: SecIntel Feeds

   Field	Guidelines
   Juniper Threat Feeds
   Command and Control	Displays whether the C&C feed is enabled or not.
   Malicious Domains	Displays whether the DNS feed is enabled or not.
   Infected Host Feed	Displays whether the infected host feed is enabled or not.
   Third Party Threat Feeds
   IP Threat Feeds
   Block List	Click the toggle button to enable block list feeds as third party feeds. Pre-defined cloud feed name— cc_ip_blocklist.
   Threatfox IP	Click the toggle button to enable Threatfox feeds as third party feeds. Pre-defined cloud feed name— cc_ip_threatfox.
   Feodo Tracker	Click the toggle button to enable Feodo feeds as third party feeds. Pre-defined cloud feed name— cc_ip_feodotracker.
   DShield	Click the toggle button to enable DShield feeds as third party feeds. Pre-defined cloud feed name— cc_ip_dhield.
   Tor	Click the toggle button to enable tor feeds as third party feeds. Pre-defined cloud feed name— cc_ip_tor.
   URL Threat Feeds
   Threatfox URL	Click the toggle button to enable Threatfox feed as third party feeds. ThreatFox is a free platform from abuse.ch with the goal of sharing indicators of compromise (IOCs) associated with malware with the infosec community, AV vendors and threat intelligence providers. The IOC can be an IP address, domain name, or URL. Pre-defined cloud feed name— cc_url_threatfox.
   URLhaus URL Threat Feed	Click the toggle button to enable URLhaus feed as third party feeds. URLhaus is a threat intelligence feed that shares malicious URLs that are used for malware distribution. Pre-defined cloud feed name— cc_url_urlhaus.
   Open Phish	Click the toggle button to enable OpenPhish feed as third party feeds. OpenPhish is a fully automated self-contained platform for phishing intelligence. It identifies phishing sites and performs intelligence analysis in real time without human intervention and without using any external resources, such as blocklists. For malware inspection, SecIntel will analyze traffic using URLs in this feed. Pre-defined cloud feed name— cc_url_openphish.
   Domain Threat Feeds
   Threatfox Domains	Click the toggle button to enable Threatfox feed as third party feeds. Pre-defined cloud feed name— cc_domain_threatfox.
   Dynamic Address Group Feeds
   Juniper DAG Feeds
   GeoIP Feed	Displays whether the GeoIP feed is enabled or not. GeoIP feed is an up-to-date mapping of IP addresses to geographical regions. This gives you the ability to filter traffic to and from specific geographies in the world.
   Third Party DAG Feeds
   office365	Click the toggle button to enable office365 IP filter feed as a third party feed. The office365 IP filter feed is an up-to-date list of published IP addresses for Office 365 service endpoints which you can use in security policies. This feed works differently from others on this page and requires certain configuration parameters, including a pre-defined cloud feed name of “ipfilter_office365”. See more instructions at the bottom of this page, including usage of the set security dynamic-address command for using this feed. Pre-defined cloud feed name— ipfilter_office365
   facebook	Click the toggle button to enable feeds from Facebook. Pre-defined cloud feed name— ipfilter_facebook
   google	Click the toggle button to enable feeds from Google. Pre-defined cloud feed name— ipfilter_google
   atlassian	Click the toggle button to enable feeds from Atlassian. Pre-defined cloud feed name— ipfilter_atlassian
   zscaler	Click the toggle button to enable feeds from Zscaler. Pre-defined cloud feed name— ipfilter_zscaler
   zpa zscaler	Click the toggle button to enable feeds from Zscaler Private Access (ZPA). The ZPA service provides secure access to the applications and services within your organization. Pre-defined cloud feed name— ipfilter_zscaler_zpa
   oracleoci	Click the toggle button to enable feeds from Oracle oci. Pre-defined cloud feed name— ipfilter_oracleoci
   cloudflare	Click the toggle button to enable feeds from Cloudflare. Pre-defined cloud feed name— ipfilter_cloudflare
   zoom	Click the toggle button to enable feeds from Zoom. Pre-defined cloud feed name— ipfilter_zoom
   microsoftazure	Click the toggle button to enable feeds from Microsoft Azure. Pre-defined cloud feed name— ipfilter_microsoftazure
   amazonaws	Click the toggle button to enable feeds from Amazon AWS. Pre-defined cloud feed name— ipfilter_amazonaws You can filter and view the DAG feeds from AWS regions and services that are relevant to you. To configure DAG Filters, do the following: Click Configure. The DAG Filter page appears. For more information, see Configure DAG Filter.
   okta	Click the toggle button to enable feeds from Okta. Pre-defined cloud feed name— ipfilter_okta
   paypal	Click the toggle button to enable feeds from Paypal. Pre-defined cloud feed name— ipfilter_paypal

   Note:

   • Starting in Junos OS Release 19.4R1, third party URL feeds are supported on Juniper ATP Cloud.

   • Since Ransomware Tracker and Malware Domain list are deprecated, ransomware tracker and malware domain list IP feeds are not supported on Juniper ATP Cloud. If you had enabled this feed earlier, you might stop receiving these feeds.

   • The update interval for a third party Internet service feed is one day.

3. Like other C&C and infected host feeds, enabled third party feeds require a security intelligence policy on the SRX Series Firewall in order to work. Example commands are provided here. See the Juniper Advanced Threat Prevention Cloud CLI Reference Guide for more information.

   • On the SRX Series Firewall: Configure a Security Intelligence Profile

     set services security-intelligence profile secintel_profile category CC

     set services security-intelligence profile secintel_profile rule secintel_rule match threat-level 10

     set services security-intelligence profile secintel_profile rule secintel_rule match threat-level 9

     set services security-intelligence profile secintel_profile rule secintel_rule then action block close

     set services security-intelligence profile secintel_profile rule secintel_rule then log

     set services security-intelligence profile secintel_profile default-rule then action permit

     set services security-intelligence profile secintel_profile default-rule then log

     set services security-intelligence profile ih_profile category Infected-Hosts

     set services security-intelligence profile ih_profile rule ih_rule match threat-level 10

     set services security-intelligence profile ih_profile rule ih_rule then action block close

     set services security-intelligence profile ih_profile rule ih_rule then log

     set services security-intelligence policy secintel_policy Infected-Hosts ih_profile

     set services security-intelligence policy secintel_policy CC secintel_profile

4. The security intelligence policy must also be added to an SRX Series Firewall policy.

   • On the SRX Series Firewall: Configure a Security Policy (Enter the following commands to create a security policy on the SRX Series Firewall for the inspection profiles.)

     set security policies from-zone trust to-zone untrust policy 1 match source-address any

     set security policies from-zone trust to-zone untrust policy 1 match destination-address any

     set security policies from-zone trust to-zone untrust policy 1 match application any

     set security policies from-zone trust to-zone untrust policy 1 then permit application-services ssl-proxy profile-name ssl-inspect-profile-dut

     set security policies from-zone trust to-zone untrust policy 1 then permit application-services security-intelligence-policy secintel_policy

   For more information on configuring the SRX Series with Juniper ATP Cloud using the available CLI commands, refer to the Juniper Advanced Threat Prevention Cloud CLI Reference Guide.

Using the office365 Feed

1. Enable theUsing the office365 Feed check box in Juniper ATP Cloud to push Microsoft Office 365 services endpoint information (IP addresses) to the SRX Series Firewall. The office365 feed works differently from other feeds on this page and requires certain configuration parameters, including a pre-defined name of “ipfilter_office365”.

2. After you enable the check box, you must create a dynamic address object on the SRX Series Firewall that refers to the ipfilter_office365 feed as follows:

   • set security dynamic-address address-name office365 profile category IPFilter feed ipfilter_office365

     Note:

     A security policy can then reference the dynamic address entry name (‘office365’ in this example) in the source or destination address.

   A sample security policy is as follows:

Use the following command to verify the office365 feed has been pushed to the SRX Series Firewall. (Update status should display Store succeeded.)

• show services security-intelligence category summary

Use the following command to show all the individual feeds under IPFILTER.

• show security dynamic-address category-name IPFilter