Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Introduction
play_arrow Dashboard
- About the Dashboard
play_arrow Monitor
- play_arrow Alerts
- play_arrow Logs
- play_arrow Maps and Charts
- play_arrow Tunnel Status
- play_arrow Service Locations
  - Service Locations Overview
- play_arrow Advanced Threat Prevention
- play_arrow Reports
  - Reports Overview
  - Managing Reports
- play_arrow Report Definitions
- play_arrow Generated Reports
  - Using Reports
- play_arrow ATP Report Definitions
- play_arrow ATP Generated Reports
  - ATP Generated Reports Overview
- play_arrow Secure Edge Reports
  - Secure Edge Reports Overview
play_arrow SRX Device Management
- play_arrow Devices
- play_arrow Device Groups
- play_arrow Preprovision Profiles
- play_arrow Configuration Templates
- play_arrow Images
- play_arrow Security Packages
play_arrow SRX Security Policy
- play_arrow SRX Security Policies
- play_arrow SRX Security Policy Rules
- play_arrow SRX Security Policy Versions
- play_arrow Device View
  - Devices with Security Policies Main Page Fields
play_arrow SRX Security Subsciptions
- play_arrow IPS Profiles
- play_arrow IPS Signatures
- play_arrow Content Security
  - Content Security Overview
  - Configure the Content Security Settings
- play_arrow Content Security Profiles
- play_arrow Web Filtering Profiles
- play_arrow Antivirus Profiles
- play_arrow Antispam Profiles
- play_arrow Content Filtering Profiles
- play_arrow Content Filtering Policies (New)
- play_arrow Decrypt Profiles
- play_arrow SecIntel
  - Security Intelligence Overview
- play_arrow SecIntel Profiles
- play_arrow SecIntel Profile Groups
- play_arrow Anti-Malware
- play_arrow Secure Web Proxy
- play_arrow Flow-Based Antivirus
- play_arrow ICAP Redirect Profile
- play_arrow Metadata Streaming Policy
- play_arrow DNS Filter
play_arrow SRX IPSec VPN
play_arrow SRX NAT
- play_arrow NAT Policies
- play_arrow NAT Pools
- Devices with NAT Policies
play_arrow SRX Identity
play_arrow Secure Edge Service Management
play_arrow Secure Edge Security Policy
play_arrow Secure Edge Security Subscriptions
play_arrow Secure Edge Service Administration
play_arrow Secure Edge Identity
play_arrow Secure Edge CASB and DLP
- About CASB and DLP
play_arrow Shared Services Firewall Policies
- play_arrow Rule Options
- play_arrow Redirect Profiles
play_arrow Shared Services Objects
- play_arrow Addresses
- play_arrow GeoIP
- play_arrow Services
- play_arrow Applications
- play_arrow Schedules
- play_arrow URL Patterns
- play_arrow URL Categories
- play_arrow SSL Initiation Profile
play_arrow Shared Services Advanced Threat Prevention
play_arrow Administration
- play_arrow Subscriptions
- play_arrow Users & Roles
- play_arrow Single Sign-On Configuration
- play_arrow Two-Factor Authentication
- play_arrow Audit Logs
  - Audit Logs Overview
  - Export Audit Logs
- play_arrow Service Updates
  - About the Service Updates Page
- play_arrow Jobs
- play_arrow Data Management
- play_arrow Log Streaming
- play_arrow URL Recategorization
  - URL Recategorization Overview
  - Request URL Recategorization
- play_arrow API Security
- play_arrow Organization
- play_arrow ATP Mapping
- play_arrow ATP Audit Logs
  - ATP Audit Logs Overview
  - Export Audit Logs
- play_arrow ATP Application Tokens

list Table of Contents

English

keyboard_arrow_right

Create and Manage Metadata Streaming Profiles to Detect DGA-Based Threats

date_range 14-Feb-25

arrow_backward

arrow_forward

In the Metadata Streaming Profiles section, click +.
The Create Metadata Streaming Profile page is displayed.
Enter a unique profile name within 63 alphanumeric characters. You can use special characters such as _ and -.
In the DNS section, enable the DGA detection toggle button.
Select the action that must be performed if a threat is detected:
- Deny—Drop the session.
- Sinkhole—Drop the session and sinkhole the request domain.
  
  Note:
  To sinkhole a request domain, you must configure the sinkhole settings for the device. To configure the settings from Juniper Security Director Cloud, click the device name on the Devices page and then click Junos Detailed Configurations > Services > Dns Filtering > Sinkhole.
- Permit—Permit the session.
Select how you want to log a request:
- Log detections—Log the request only if a threat is detected.
- Log everything—Log all requests received by the device.
Enable the Fallback options log toggle button to log the request if no threat is detected.
In the Verdict timeout text box, enter the duration for which the device must wait for a response from Juniper Security Director Cloud.
To store DNS requests in cache, enable the Cache TTL toggle button and enter the duration for which requests from benign and command-and-control (C2) domains must be stored.
Click OK.
The metadata streaming profile is created and displayed on the Metadata Streaming Policy page.

Manage Metadata Streaming Profiles

Edit—Select the profile, and then click .
Clone—Select the profile, and then click More > Clone.

Note:
By default, the profile name is suffixed with _copy_1.
Delete—Select the profile, and then click .

arrow_backward PREVIOUS Create and Manage Metadata Streaming Profiles to Detect all DNS Threats

NEXT arrow_forward Create and Manage Metadata Streaming Profiles to Detect DNS Tunnels

footer-navigation