- play_arrow What's New for JSA Users
- play_arrow Capabilities in your JSA product
- play_arrow Dashboard Management
- Dashboard Management
- Default Dashboards
- Custom Dashboards
- Creating a Custom Dashboard
- Using the Dashboard to Investigate Log or Network Activity
- Configuring Dashboard Chart Types
- Removing Dashboard Items
- Detaching a Dashboard Item
- Renaming a Dashboard
- Deleting a Dashboard
- Managing System Notifications
- Adding Search-based Dashboard Items to the Add Items List
- play_arrow QRadar Analyst Workflow
- play_arrow Offense Management
- play_arrow Log Activity Investigation
- play_arrow Asset Management
- play_arrow Chart Management
- play_arrow Event and Flow Searches
- play_arrow Custom Event and Flow Properties
- play_arrow Rules
- play_arrow Historical Correlation
- play_arrow Juniper Networks X-Force Integration
- play_arrow Report Management
Superflows
JSA analyzes individual flows to look for indicators that common attack vectors are being used on your network. When the number of flows that match the criteria reaches a specified number, JSA groups the individual flows into a superflow. Each superflow counts as only one flow against the flows per minute (FPM) license, regardless of how many flow records are bundled within it.
You can configure the flow threshold to control the number of unique flows that must match the criteria before a superflow is created. Given a threshold of 100, the first 99 flows are sent as normal flow records. The 100th flow and subsequent matching flows are included in the superflow record. JSA continues to report on the superflow every minute, until one full interval passes with no matching traffic. Because a superflow is kept alive even if only one flow record matches, some superflows might appear to be small.
If you do not want JSA to create superflows, in the Flow Processor configuration settings, change the Create Super Flows setting to No.
Superflow Type A: Network Scan
A network scan attempts to discover all of the active hosts on your network and map the hosts to an IP address.
JSA looks for flows where one host sends data to many hosts, and flags this type of activity as a Type A superflow. This unidirectional flow is an aggregate of all of the flows that have the same source IP with different destination IPs, but the following parameters are the same:
Protocol
Source bytes-to-packets ratio
Source IP address
Destination port (TCP and UDP flows only)
TCP flags (TCP flows only)
ICMP type and code (ICMP flows only)
Superflow Type B: Distributed Denial of Service (DDoS)
A DDoS attack occurs when multiple systems flood the bandwidth or resources of a targeted system.
JSA looks for flows where many hosts send data to one destination host, and flags this activity as a Type B superflow. This unidirectional flow is an aggregate of all of the flows that have different source IPs with a single destination IP, but the following parameters are the same:
Protocol
Source bytes-to-packets ratio
Destination IP address
Destination port (TCP and UDP flows only)
TCP flags (TCP flows only)
ICMP type and code (ICMP flows only)
Superflow Type C: Port Scan
A port scan attempts to identify the ports that are in use by a specific host on your network.
JSA looks for flows that have one source IP and one destination IP, but many ports. This unidirectional flow is an aggregate of all non-ICMP flows that have different source or destination ports, but the following parameters are the same:
Protocol
Source IP address
Destination IP address
Source bytes-to-packets ratio
TCP flags (TCP flows only)
