Juniper DDoS Secure
What is Discovered and Monitored
| Protocol | Information Discovered | Metrics Collected | Used For |
|---|---|---|---|
| Syslog | DDoS Alerts | Security Monitoring |
Event Types
In ADMIN > Device Support > Event, search for "juniper ddos" in the Device Type and Description columns to see the event types associated with this device.
- Juniper-DDoS-Secure-WorstOffender
- Juniper-DDoS-Secure-Blacklisted
- Juniper-DDoS-Secure-Generic
Rules
There are no predefined rules for this device.
Reports
There are no predefined reports for this device.
Settings for Access Credentials
Set these Access Method Definition values to allow FortiSIEM to communicate with your device.
| Setting | Value |
|---|---|
| Name | <set name> |
| Device Type | Juniper DDos Secure |
| Access Protocol | See Access Credentials |
| Port | See Access Credentials |
| Password config | See Password Configuration |
Configuration
Configure the device to send syslog to FortiSIEM. Make sure that the event matches the format specified below.
<134>Juniper: End : 117.217.141.32 : IND: Worst Offender: Last Defended 66.145.37.254: TCP Attack - Port Scan (Peak 55/s, Occurred 554) <134>Juniper: End : 78.143.172.52 : IRL: IP Address Temp Black-Listed (Valid IP) Exceeds SYN + RST + F2D Count (Peak 114/s, Dropped 83.5K pkts)