Integrating with Juniper Firewall

Overview

Blumira’s modern cloud SIEM platform integrates with Juniper firewall to stream security event logs to Blumira. With ready-to-use firewall traffic detection rules, Blumira can help you catch risky connections from public IPs, egress/ingress bulk transfers, and activity related to known threat sources that you may want to block.

Before you begin

This integration requires a Blumira sensor to be installed before you can complete the steps below. Ensure that you complete the steps in Building a Blumira sensor with Ubuntu before you continue.

Gather the IP address of your Blumira sensor to use when configuring the external service.

To find and copy the IP address of the sensor, do the following:

1. In Blumira, navigate to Ingestion > Sensors.
2. Click the sensor row to open the details page.
3. In the Overview section, next to Host Details, copy the IP address.

Configuring log forwarding

Sending Juniper system logs

To begin forwarding Juniper system logs to Blumira, choose one of the following methods:

• To forward logs using J-Web, do the following:
  1. Log in to the Juniper SRX device.
  2. Click Configure > CLI Tools > Point and Click CLI in the Juniper SRX device.
  3. Expand System and click Syslog.
  4. In the Syslog page, click Add New Entry placed next to "Host."
  5. Enter the IP address of the remote Syslog server (i.e., Firewall Analyzer).
  6. Click Apply.
• To forward logs using the CLI, do the following:
  1. Log in to the Juniper SRX device CLI console.
  2. Execute the following command: 
     set system syslog host <sensor IP address> any any

Reference: See additional information provided by Juniper in SRX Getting Started - Configure System Logging.

Sending traffic logs

After you configure log forwarding, you can send traffic logs to a file on your Blumira sensor. You need to prepare the log location and enable logging for security policies to send traffic logs.

Preparing log location

In event mode, traffic logs can be stored in a remote Syslog server, i.e. your Blumira sensor. We recommend using a separate file for logging only traffic log data and setting the severity level to "any" so that traffic log messages are captured.

To send traffic logs to your Blumira sensor, do the following:  

1. Execute the following command to set the system Syslog host to the location of your Blumira sensor: 

user@host# set system Syslog host <sensor IP address> any any

2. Execute the following command to set the system Syslog server location to match "RT_FLOW_SESSION":

user@host# set system Syslog host 192.30.80.65 match "RT_FLOW_SESSION"

3. Execute the following command to set the security log mode to event: 

user@host# set security log mode event

Enabling logging

You can specify if traffic logs are generated when a session closes and when a session starts. We recommend configuring traffic logs to generate when a session closes because the logs will include traffic volume, NAT information, and the reason code for termination. To enable logging for a security policy that has a deny action, you must specify that traffic logs are generated when a session starts.

To enable logging for a security policy, do the following:

1. Execute a command for the security policy that sets traffic logs to generate when a session closes.
   Example: In this example, we enable the security default-permit policy.

   user@host# set security policies from-zone trust to-zone untrust policy default-permit then log session-close

2. (Optional) Execute a command for the security policy specifying that traffic logs generate when a session starts.
   Example: 

   user@host# set security policies from-zone trust to-zone untrust policy default-permit then log session-init

Reference: See additional information provided by Juniper in SRX Getting Started - Configure Traffic Logging (Security Policy Logs) for SRX Branch Devices.