JSA Tuning

Configuring JSA Tuning

You can tune JSA to meet the needs of your environment.

Before you tune JSA, wait one day to enable JSA to detect servers on your network, store events and flows, and create offenses that are based on existing rules.

Administrators can perform the following tuning tasks:

• Optimize event and flow payload searches by enabling a payload index on the Log Activity and Network Activity property.

• Provide a faster initial deployment and easier tuning by automatically or manually adding servers to building blocks.

• Configure responses to event, flow, and offense conditions by creating or modifying custom rules.

• Ensure that each host in your network creates offenses that are based on the most current rules, discovered servers, and network hierarchy.

Payload Indexing

Use the Quick Filter function, which is available on the Log Activity and Network Activity tabs, to search event and flow payloads.

To optimize the Quick Filter, you can enable a payload index Quick Filter property.

Enabling payload indexing might decrease system performance. Monitor the index statistics after you enable payload indexing on the Quick Filter property.

For more information, see the Juniper Secure Analytics Administration Guide.

Enabling Payload Indexing

You can optimize event and flow payload searches by enabling a payload index on the Log Activity and Network Activity Quick Filter property.

To enable the payload indexing:

1. Click the Admin tab.

2. In the System Configuration section, click System Configuration.

3. Click the Index Management icon.

4. In the Quick Search field, type quick filter:

5. Right-click the Quick Filter property that you want to index.

6. Click Enable Index.

7. Click Save, and then click OK.

8. Optional: To disable a payload index, choose one of the following options:

   • Click Disable Index.

   • Right-click a property and select Disable Index from the menu.

For more information, see the Juniper Secure Analytics Administration Guide.

Servers and Building Blocks

JSA automatically discovers and classifies servers in your network, providing a faster initial deployment and easier tuning when network changes occur.

To ensure that the appropriate rules are applied to the server type, you can add individual devices or entire address ranges of devices. You can manually enter server types, that do not conform to unique protocols, into their respective Host Definition Building Block. For example, adding the following server types to building blocks reduces the need for further false positive tuning:

• Add network management servers to the BB:HostDefinition: Network Management Servers building block.

• Add proxy servers to the BB:HostDefinition: Proxy Servers building block.

• Add virus and Windows update servers to the BB:HostDefinition: Virus Definition and Other Update Servers building block.

• Add vulnerability assessment (VA) scanners to the BB-HostDefinition: VA Scanner Source IP building block.

The Server Discovery function uses the asset profile database to discover several types of servers on your network. The Server Discovery function lists automatically discovered servers and you can select which servers you want to include in building blocks.

For more information about discovering servers, see the Juniper Secure Analytics Administration Guide.

Using Building blocks, you can reuse specific rule tests in other rules. You can reduce the number of false positives by using building blocks to tune JSA and enable extra correlation rules.

Adding Servers to Building Blocks Automatically

The Server Discovery function uses the asset profile database to discover different server types that are based on port definitions. Then, you can select the servers to add to a server-type building block for rules.

1. Click Assets > Server Discovery.

2. In the Server Type list, select the server type that you want to discover.

   Keep the remaining parameters as default.

3. Click Discover Servers.

4. In the Matching Servers pane, select the checkbox of all servers you want to assign to the server role.

5. Click Approve Selected Servers.

   Note:

   You can right-click any IP address or host name to display DNS resolution information.

Adding Servers to Building Blocks Manually

If a server is not automatically detected, you can manually add the server to its corresponding Host Definition Building Block.

To add servers to building blocks manually:

1. Click the Offenses tab.

2. In the navigation pane, click Rules.

3. In the Display list, select Building Blocks.

4. In the Group list, select Host Definitions.

   The name of the building block corresponds with the server type. For example, BB:HostDefinition: Proxy Servers applies to all proxy servers in your environment.

5. To manually add a host or network, double-click the corresponding Host Definition Building Block appropriate to your environment.

6. In the Building Block field, click the underlined value for the source or destination IP address.

7. In the Enter an IP address or CIDR field, type the host names or IP address ranges that you want to assign to the building block.

8. Click Add > Submit.

9. Click Finish.

10. Repeat Step 1 to 9 for each server type that you want to add.

Configuring Rules

From the Log Activity, Network Activity, and Offenses tab, you can configure rules or building blocks.

To configure rules:

1. Click the Offenses tab.

2. Double-click the offense that you want to investigate.

3. Click Display >Rules.

4. Double-click a rule.

   You can further tune the rules. For more information about tuning rules, see the Use Case Manager Guide

5. Close the Rules wizard.

   The Creation Date property changes to the date and time when you last updated a rule.

6. In the Rules page, click Actions.

7. Optional: If you want to prevent the offense from being removed from the database after the offense retention period is elapsed, select Protect Offense.

8. Optional: If you want to assign the offense to a JSA user, select Assign.

Cleaning the SIM Data Model

Clean the SIM data model to ensure that each host creates offenses that are based on the most current rules, discovered servers, and network hierarchy.

To clean the SIM model

1. Click the Admin tab.

2. On the toolbar, select Advanced >Clean SIM Model.

3. Select an option:

   • Soft Clean to set the offenses to inactive.

   • Soft Clean with the optional Deactivate all offenses check box to close all offenses.

   • Hard Clean to erase all entries.

4. Select the Are you sure you want to reset the data model checkbox.

5. Click Proceed.

6. After the SIM reset process is complete, refresh your browser.

When you clean the SIM model, all existing offenses are closed. Cleaning the SIM model does not affect existing events and flows.