Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Announcement: Try the Ask AI chatbot for answers to your technical questions about Juniper products and solutions.

close
external-header-nav
Documentation
Menu
License Guide
Quick Starts
Validated Designs
Home Documentation JSA Series Virtual Appliance Juniper Secure Analytics Configuring DSMs Guide Verdasys Digital Guardian

Juniper Secure Analytics Configuring DSMs Guide

keyboard_arrow_up
close
keyboard_arrow_left
Juniper Secure Analytics Configuring DSMs Guide
Table of Contents Expand all
list Table of Contents
file_download PDF
{ "lLangCode": "en", "lName": "English", "lCountryCode": "us", "transcode": "en_US" }
English
keyboard_arrow_right

Configuring a Data Export

date_range 27-Mar-21
arrow_backward
arrow_forward

Data exports give you the option to configure the events Verdasys Digital Guardian forwards to JSA.

  1. Log in to the Digital Guardian Management Console.
  2. Select Workspace >Data Export >Create Export.
  3. From the Data Sources list, select Alerts or Events as the data source.
  4. From the Export type list, select JSA LEEF.

    If your Verdasys Digital Guardian is v6.0.x, you can select Syslog as the Export Type. JSA LEEF is the preferred export type format for all Verdasys Digital Guardian appliances with v6.1.1 and later.

  5. From the Type list, select UDP or TCP as the transport protocol.

    JSA can accept syslog events from either transport protocol. If the length of your alert events typically exceeds 1024 bytes, then you can select TCP to prevent the events from being truncated.

  6. In the Server field, type the IP address of your JSA console or Event Collector.
  7. In the Port field, type 514.
  8. From the Severity Level list, select a severity level.
  9. Select the Is Active check box.
  10. Click Next.
  11. From the list of available fields, add the following Alert or Event fields for your data export:

    • Agent Local Time

    • Application

    • Computer Name

    • Detail File Size

    • IP Address

    • Local Port

    • Operation (required)

    • Policy

    • Remote Port

    • Rule

    • Severity

    • Source IP Address

    • User Name

    • Was Blocked

    • Was Classified

  12. Select a Criteria for the fields in your data export and click Next.

    By default, the Criterion is blank.

  13. Select a group for the criteria and click Next.

    By default, the Group is blank.

  14. Click Test Query.

    A Test Query ensures that the database runs properly.

  15. Click Next.
  16. Save the data export.

    The configuration is complete.

The data export from Verdasys Digital Guardian occurs on a 5-minute interval. You can adjust this timing with the job scheduler in Verdasys Digital Guardian, if required. Events that are exported to JSA by Verdasys Digital Guardian are displayed on the Log Activity tab.

arrow_backward PREVIOUS Configuring IPtables
NEXT arrow_forward Syslog Log Source Parameters for Verdasys Digital Guardian
external-footer-nav