- play_arrow JSA Risk Manager
- play_arrow JSA Risk Manager configuration
- play_arrow Network Device Management
- play_arrow Network Device Management
- Device Discovery Process
- Discovering Devices in your Network
- Importing Multiple Devices from a CSV File
- Adding a Network Device to JSA Risk Manager
- Deleting a Device from JSA Risk Manager
- Finding Network Devices in the Device List
- Adding Device Information to the Topology
- Collecting Neighbor Data to Update the Topology
- Configuring the Discovery Schedule to Populate Device Information
- play_arrow Device Configuration Backup Jobs
- play_arrow Network Connections Overview
- play_arrow Network Connections Overview
- play_arrow Network Device Configuration and Monitoring
- play_arrow Network Device Configuration and Monitoring
- Searching Device Rules
- Filtering Device Rules by User or Group
- Comparing the Configuration of your Network Devices
- Adding or Deleting a Device in JSA Risk Manager
- Backing up a Device to get its Configuration Data
- Discovering Devices in your Network
- play_arrow Log Source Mapping in JSA
- play_arrow Protocol Configuration for Network Devices
- play_arrow Schedules for Discovery and Backup
- play_arrow Firewall Rule Event Counts of Check Point Devices
- play_arrow Network Topology
- play_arrow Network Topology
- play_arrow CIS Benchmark Scans
- play_arrow Network Simulations in JSA Risk Manager
- play_arrow Network Simulations in JSA Risk Manager
- Simulation Tests
- Creating a Simulation
- Duplicating a Simulation
- Manually Running a Simulation
- play_arrow Network Configuration Change Simulation
- Simulating an Attack on an SSH Protocol
- Viewing Simulation Results
- Approving Simulation Results
- Revoking a Simulation Approval
- Assigning Simulations to Group for Tracking
- play_arrow Topology models
- play_arrow Reports
- play_arrow Audit Log Data
Restrictive Question Parameters for Actual Communication Tests
SUMMARY The actual communication tests for assets include restrictive questions and parameters that you can choose when you create a Policy Monitor test.
When you apply the exclude condition to a test, the exclude condition applies to the protocols parameter.
For example, if you configure this test to exclude the following protocols, the test returns only assets that do not use the excluded protocols.
The following table lists and describes the restrictive question parameters for actual communication tests.
| Test Name | Description |
|---|---|
| include only the following protocols | Filters assets from the contributing test that include or exclude the specified protocols. This test is only selectable when a contributing asset test is added to this question. |
| include only the following inbound ports | Filters assets from the contributing test that include only or exclude the specified ports. This test is only selectable when a contributing asset test is added to this question. |
| include only the following inbound applications | Filters assets from the contributing test question that include only or exclude any inbound or outbound applications. This test filters connections that include only flow data. |
| include only if the source inbound and destination outbound bytes have a percentage difference less than 10 | Filters assets from the contributing test question that is based on communications with a specific ratio of inbound to outbound (or outbound to inbound) bytes. This test is useful for detecting hosts that might be exhibiting proxy type behavior (inbound equals outbound). |
| include only if the inbound and outbound flow count has a percentage difference less than 10 | Filters assets from the contributing test question that is based on communications with a specific ratio of inbound to outbound (or outbound to inbound) flows. This test filters connections that include flow data when flow count is selected. This restrictive test requires two contributing tests that specify a source and destination. The following test outlines a set of questions that are trying to determine what assets between two points have an inbound and outbound percentage difference greater than 40%. For example, Contributing test - have accepted communication to the Internet. Contributing test - and have accepted communication from the Internet. Restrictive test - and include only if the inbound and outbound flow count has a percentage difference greater than 40. |
| include only if the time is between start time and end time inclusive | Filters communications within your network that occurred within a specific time range. Run this test to detect out-of-policy communications. For example, if your corporate policy allows FTP communications between 1 and 3 AM, this test can detect any attempt to use FTP to communicate outside of that time range. |
| include only if the day of week is between start day and end day inclusive | Filters assets from the contributing test question based on network communications that occurred within a specific time range. Run this test to detect out-of-policy communications. |
| include only if susceptible to vulnerabilities that are exploitable. | Filters assets from a contributing test question that is searching for specific vulnerabilities and restricts results to exploitable assets. This restrictive test does not contain configurable parameters, but is used along with the contributing test, are susceptible to one of the following vulnerabilities. This contributing rule that contains a vulnerabilities parameter is required. |
| include only the following networks | Filters assets from a contributing test question that includes or excludes the configured networks. |
| include only the following asset building blocks | Filters assets from a contributing test question that are or are not associated with the configured asset building blocks. |
| include only the following asset saved searches | Filters assets from a contributing test question that are or are not associated with the asset saved search. |
| include only the following reference sets | Filters assets that are from a contributing test question that includes or excludes the configured reference sets. |
| include only the following IP addresses | Filters assets that are or are not associated with the configured IP addresses. |
| include only if the Microsoft Windows service pack for operating systems is below 0 | Filters assets to determine whether a Microsoft Windows service pack level for an operating system is under the level your company policy specifies. |
| include only if the Microsoft Windows security setting is less than 0 | Filters assets to determine whether a Microsoft Windows security setting is under the level your company policy specifies. |
| include only if the Microsoft Windows service equals status | Filters assets to determine whether a Microsoft Windows service is unknown, boot, kernel, auto, demand, or disabled. |
| include only if the Microsoft Windows setting equals regular expressions | Filters assets to determine whether a Microsoft Windows Setting is the specified regular expression. |
