close
keyboard_arrow_left
Table of Contents
- play_arrow JSA Risk Manager
- play_arrow JSA Risk Manager configuration
- play_arrow Network Device Management
- play_arrow Network Device Management
- Device Discovery Process
- Discovering Devices in your Network
- Importing Multiple Devices from a CSV File
- Adding a Network Device to JSA Risk Manager
- Deleting a Device from JSA Risk Manager
- Finding Network Devices in the Device List
- Adding Device Information to the Topology
- Collecting Neighbor Data to Update the Topology
- Configuring the Discovery Schedule to Populate Device Information
- play_arrow Device Configuration Backup Jobs
- play_arrow Network Connections Overview
- play_arrow Network Connections Overview
- play_arrow Network Device Configuration and Monitoring
- play_arrow Network Device Configuration and Monitoring
- Searching Device Rules
- Filtering Device Rules by User or Group
- Comparing the Configuration of your Network Devices
- Adding or Deleting a Device in JSA Risk Manager
- Backing up a Device to get its Configuration Data
- Discovering Devices in your Network
- play_arrow Log Source Mapping in JSA
- play_arrow Protocol Configuration for Network Devices
- play_arrow Schedules for Discovery and Backup
- play_arrow Firewall Rule Event Counts of Check Point Devices
- play_arrow Network Topology
- play_arrow Network Topology
- play_arrow CIS Benchmark Scans
- play_arrow Network Simulations in JSA Risk Manager
- play_arrow Network Simulations in JSA Risk Manager
- Simulation Tests
- Creating a Simulation
- Duplicating a Simulation
- Manually Running a Simulation
- play_arrow Network Configuration Change Simulation
- Simulating an Attack on an SSH Protocol
- Viewing Simulation Results
- Approving Simulation Results
- Revoking a Simulation Approval
- Assigning Simulations to Group for Tracking
- play_arrow Topology models
- play_arrow Reports
- play_arrow Audit Log Data
list Table of Contents
Policy Monitor Questions to Assess and Monitor Risk
date_range
08-Aug-21
SUMMARY You can define questions in Policy Monitor to assess and monitor risk based on network activity, vulnerabilities, and firewall rules.
When you submit a question, the topology search is based on the data type that you selected:
- For questions based on assets, the search is based on the network assets that violated a defined policy or assets that introduced risk into the network.
- For questions based on devices or rules, the search either identifies the rules in a device that violated a defined policy or introduced risk into the network.
- If a question is based on asset compliance, the search identifies if an asset is compliant with a CIS benchmark.
Important: If you configured JSA for multiple domains, asset questions monitor
only assets in your default domain. Asset compliance questions monitor assets in your
default domain unless you configured another domain in the Domain
Management window in the Admin tab. For more
information about domain management, see the Juniper Secure Analytics
Administration Guide.
Devices or rules questions look for violations in rules and policy and do not have restrictive test components. You can also ask devices or rules questions for applications.
Asset tests are divided into these categories:
- A contributing test uses the question parameters to examine the risk indicators that are specified in the question. Risk data results are generated, which can be further filtered by using a restrictive test. Contributing tests are shown in the Which tests do you want to include in your question area. Contributing tests return data based on assets detected that match the test question.
- A restrictive test narrows the results that are returned by a contributing test question. Restrictive tests display only in the Which tests do you want to include in your question area after a contributing test is added. You can add restrictive tests only after you include a contributing test in the question. If you remove or delete a contributing test question, the restrictive test question cannot be saved.
Asset compliance questions look for assets that are not in compliance with CIS benchmarks. The tests that are included in the CIS benchmark are configured with the Compliance Benchmark Editor.
