Juniper X-Force Exchange Plug-in for JSA
The Juniper X-Force Exchange (XFE) is a sharing platform for threat intelligence that is used by security analysts, network security specialists, and security operations center teams.
The X-Force Exchange (XFE) plug-in provides the option to search the information on the X-Force Exchange website for IP addresses, URLs, CVEs, and web applications that are found in JSA.
For example, you can right-click a URL from a JSA event to see what data the X-Force Exchange contains about the URL.
You can also use the right-click lookup option to submit IP addresses or URL data from JSA searches, offenses, and rules to a public or private collection. The collection stores the information in one place as you use the data for more research.
Collections also contain a section that serves as a wiki-style notepad, where you can add comments or any free text that is relevant. You can use the collection to save X-Force reports, text comments, or any other content. An X-Force report has both a version of the report from the time that it was saved and a link to the current version of the report.
Juniper X-Force Exchange Right-click Plug-in Installation
Install the X-Force Exchange plug-in on your JSA Console so that you have right-click functionality to access data in X-Force Exchange.
This procedure requires a web server restart from the Admin tab to load the plug-in after the RPM is installed. Restarting the web server logs out all JSA users, so it is advised that you install this plug-in during scheduled maintenance.
If your JSA system is version 2014.4 or later, the plug-in is already installed. Administrators can verify that the plug-in is installed by right-clicking on any IP address in JSA, and selecting More Options >Plugin options. If the Juniper X-Force Exchange lookup is displayed, then the plug-in is installed.
Download the X-Force Exchange right-click plug-in from https://ibm.biz/BdX4BW.
Copy the RPM file to the JSA console.
Type the following command to install the plug-in: rpm -Uvh RightClick-XFE-7.2.<version>.x86_64.rpm
Log in to the JSA console as an admin user.
On the navigation menu (
), click Admin.Select Advanced >Restart Web Server.
After the web server restarts, the X-Force right-click plug-in is enabled for IP addresses in JSA for URL fields in the Log Activity tab.
Log in to the pop-up window for the X-Force Exchange website by using your IBM id, or continue as a guest.
Guest users are not able to use all features on the X-Force Exchange website.
Close the browser window after the initial login to the Juniper X-Force Exchange website.