Alert Pack: DoS detection

[ 1 Purpose ] [ 2 Prerequisites ] [ 3 Open alert pack ] [ 4 Use alert pack ]

Purpose

This alert pack is a single alert for detecting DoS attacks used to test the Use Case DoS detection.

DoS Detection

Possible attack Denial of Service from sourceIP to destinationIP not detected by Firewall (action Accept).

from firewall.juniper.ssg.traffic
where action = "accept", ispublic(srcIp)
select str(srcIp) as sourceIP
select str(dstIp) as destinationIP
where isnotnull(sourceIP),isnotnull(destinationIP)
group every 1m by sourceIP, destinationIP, dstPort
every 1m
select count() as count
where isnotnull(dstPort)
where count >= 10

Prerequisites

When installed as part of the use case mentioned above, everything will be sorted automatically.

When installed as an independent item, you must have the following data source available in your domain:

firewall.juniper.ssg.traffic ^{learn more}

Open alert pack

Once you have installed the alert pack, you can use the Open button at the top right of the card in Exchange to access the Alert configuration, where you can apply filters to find it and later manage it as required. You can also access this area via the Navigation pane (Administration → Alert Configuration → Available alerts).

Use alert pack

The alerts in the alert pack are deactivated by default when the alert pack is installed. Access the Alert configuration area to activate those you need and assign sending policies to receive them through the desired channels.