Catalog > All Topics

Implementing Juniper Networks Secure Analytics (IJSA)

Juniper Networks
3 Days
Download Course Outline
$2,395.00
Request a Quote
Credit not applicable
Share
Schedule
Export to CSV
  • No schedule events found for this course.
      • PC
        Private Class
        Privately train a group of your employees at your facility, virtually, or any of our locations.
    Request
  • LCLive Classroom
    Live Classroom
    Learn and interact with your instructor and peers in-person in our classrooms.
  • VCVirtual Classroom
    Virtual Classroom
    Attend any of our instructor-led classes virtually regardless of your physical location.
  • PCPrivate Class
    Private Class
    Privately train a group of your employees at your facility, virtually, or any of our locations.
  • GTRGuaranteed to Run
    Guaranteed to Run
    GTR classes are guaranteed to run as promised and delivered.
Course Summary
Show All

Description

This three-day course discusses the configuration of Juniper Networks JSA Series Secure Analytics (formerly known as Security Threat Response Manager [STRM]) in a typical network environment. Key topics include deploying a JSA Series device in the network, configuring flows, running reports, and troubleshooting. Through demonstrations and hands-on labs, students will gain experience in configuring, testing, and troubleshooting the JSA Series device. This course uses the Juniper Networks Secure Analytics (JSA) VM virtual appliance for the hands-on component. This course is based on JSA software 2014.2R4.
 

Objectives

After successfully completing this course, you should be able to:

  • Explain the role of the Network Director.
  • Describe the JSA system and its basic functionality.
  • Describe the hardware used with the JSA system.
  • Identify the technology behind the JSA system.
  • Identify the JSA system’s primary design divisions—display versus detection, and events versus traffic.
  • Plan and prepare for a new installation.
  • Access the administration console.
  • Configure the network hierarchy.
  • Configure the automatic update process.
  • Access the Deployment Editor.
  • Describe the JSA system’s internal processes.
  • Describe event and flow source configuration.
  • List key features of the JSA architecture.
  • Describe the JSA system’s processing logic.
  • Interpret the correlation of flow and event data.
  • List the architectural component that provides each key function.
  • Describe Events and explain where they come from.
  • Access the Log Activity interface.
  • Execute Event searches.
  • Describe flows and their origin.
  • Configure the Network Activity interface.
  • Execute Flow searches.
  • Specify the JSA system’s Asset Management and Vulnerability Assessment functionality.
  • Access the Assets interface.
  • View Asset Profile data.
  • View Server Discovery.
  • Access the Vulnerability Assessment Scan Manager to produce vulnerability assessments (VAs).
  • Access vulnerability scanner configuration.
  • View vulnerability profiles.
  • Describe rules.
  • Configure rules.
  • Configure Building Blocks (BBs).
  • Explain how rules and flows work together.
  • Access the Offense Manager interface.
  • Understand Offense types.
  • Configure Offense actions.
  • Navigate the Offense interface.
  • Explain the Offense summary screen.
  • Search Offenses.
  • Use the JSA system’s Reporting functionality to produce graphs and reports.
  • Navigate the Reporting interface.
  • Configure Report Groups.
  • Demonstrate Report Branding.
  • View Report formats.
  • Identify the basic information on maintaining and troubleshooting the JSA system.
  • Navigate the JSA dashboard.
  • List flow and event troubleshooting steps.
  • Access the Event Mapping Tool.
  • Configure Event Collection for Junos devices.
  • Configure Flow Collection for Junos devices.
  • Explain High Availability (HA) functionality on a JSA device.

Prerequisites

This course assumes that students have basic networking knowledge and experience in the following areas:

  • Understanding of TCP/IP operation;
  • Understanding of network security concepts; and
  • Experience in network security administration.

Who Should Attend

This course is intended for network engineers, support personnel, reseller support, and anyone responsible for implementing the JSA system.

 

Outline

Day 1 Chapter 1: Course Introduction Chapter 2: Product Overview

  • Overview of the JSA Series Device
  • Hardware
  • Collection
  • Operational Flow
Chapter 3: Initial Configuration
  • A New Installation
  • Administration Console
  • Platform Configuration
  • Deployment Editor
  • Lab 1: Initial Configuration
Chapter 4: Architecture
  • Processing Log Activity
  • Processing Network Activity
  • JSA Deployment Options
Chapter 5: Log Activity
  • Log Activity Overview
  • Configuring Log Activity
  • Lab 2: Log Activity
Day 2 Chapter 6: Network Activity
  • Network Activity Overview
  • Configuring Network Activity
  • Lab 3: Network Activity
Chapter 7: Assets and Vulnerability Assessment
  • Asset Interface
  • Vulnerability Assessment
  • Vulnerability Scanners
  • Lab 4: Assets and Vulnerability Assessment
Chapter 8: Rules
  • Rules
  • Configure Rules and Building Blocks
  • Lab 5: Rules
Chapter 9: Offense Manager
  • Offense Manager
  • Offense Manager Configuration
  • Offense Investigation
  • Lab 6: Configure the Offense Manager
Day 3 Chapter 10: JSA Reporting
  • Reporting Functionality
  • Reporting Interface
  • Lab 7: Reporting
Chapter 11: Basic Tuning and Troubleshooting
  • Basic Tuning
  • Troubleshooting
Chapter 12: Configuring Junos Devices for Use with JSA
  • Collecting Junos Events
  • Collecting Junos Flows
  • Lab 8: Configuring Junos Devices for JSA
Appendix A: High Availability
  • High Availability
  • Configuring High Availability