Asset Profile Configuration
JSA automatically discovers the assets on your network, which are discovered by passive monitoring of flow data, and active monitoring of vulnerability scan data. JSA then builds an asset profile, which displays the services that run on each asset.
The asset profile data is used for correlation purposes to help reduce false positives. For example, if an attack attempts to exploit a specific service that runs on a specific asset, JSA determines whether the asset is vulnerable to this attack by correlating the attack against the asset profile.
Flow data, vulnerability assessment (VA) scanners, or log sources that provide identity must be configured so that asset profiles are displayed in the user interface. If no flow data or scanners exist, no data is compiled for an asset profile.
You can define specific IP addresses (servers) as assets by importing existing assets in comma-separated value (CSV) format. Adding an asset profile helps you to identify an IP address by name and provide a description and weight for that asset.
For more information about managing assets, see the Juniper Secure Analytics Administration Guide.
Asset Profile Data in CSV Format
An asset profile is a collection of information about a specific asset. The profile includes information about the services that are running on the asset and any identity information that is known. You can import asset profile data in CSV format.
When you import asset profile data in CSV format, the file must be in the following format:
ip,name,weight,description
The following table describes the parameters that you must configure.
Parameter |
Description |
|---|---|
IP |
Specifies any valid IP address in the dot decimal format, for example, 192.168.5.34. |
Name |
Specifies the name of the asset up to 255 characters in length. Commas are not valid in this field because they invalidate the import process, for example, WebServer01. |
Weight |
Specifies a number 0 - 10, which indicates the importance of the asset on your network. A value of 0 denotes low importance, while 10 denotes a high importance. |
Description |
Specifies a textual description for this asset up to 255 characters in length. This value is optional. |
The following entries can be included in a CSV file:
192.168.5.34,WebServer01,5,Main Production Web Server192.168.5.35,MailServ01,0,
The CSV import process merges any asset profile information that is stored in your JSA system.
For more information about configuring assets, see the Juniper Secure Analytics Administration Guide.