Versions Compared

Old Version 1

changes.mady.by.user Borja Moro Moreno

Saved on

compared with

New Version 2

changes.mady.by.user Borja Moro Moreno

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Table of Contents
minLevel1
maxLevel2
outlinefalse
typeflat
separatorbrackets
printablefalse

...

Purpose

This Alert Pack is a single alert for detecting DoS attacks used for testing a Port Scan Use Case.

Included alerts

Port Scan Detection

This alert detects an IP that is suspicious of doing a port scan attack in sending requests to more than 100 different ports in a period of 5 minutes.

Code Block
from firewall.juniper.ssg.traffic
where ispublic(srcIp)
where action = "Accept"
select str(srcIp) as sourceIP
group every 1m by sourceIP
every 1m
select hllppcount(dstPort) as dstPorthll
where dstPorthll >= 10
select round(dstPorthll) as dstPortRound

Prerequisites

When installed as part of the use case mentioned above, everything will be sorted automatically.

...

Open alert pack

Once you have installed the desired alerts individually, you can use the Open button at the top right of the card in Exchange to access the Alert configuration, where you can apply filters to find them and later manage them as required. You can also access this area via the Navigation pane (Administration → Alert Configuration → Available alerts).

...

Use alert pack

The alerts installed are deactivated by default. Access the Alert configuration area to activate those you need and assign sending policies to receive them through the desired channels.