[role="xpack"]

:modulename: juniper
:has-dashboards: false

== Juniper module

include::{libbeat-dir}/shared/integration-link.asciidoc[]

This is a module for ingesting data from the different Juniper Products. Currently supports these filesets:

- `srx` fileset: Supports Juniper SRX logs
- `junos` fileset: Supports Juniper JUNOS logs
- `netscreen` fileset: Supports Juniper Netscreen logs

include::../include/gs-link.asciidoc[]

include::../include/configuring-intro.asciidoc[]

include::../include/config-option-intro.asciidoc[]

:fileset_ex: srx
beta[]

[float]
==== `srx` fileset settings

The Juniper-SRX module only supports syslog messages in the format "structured-data + brief" https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/structured-data-edit-system.html[JunOS Documentation structured-data]

To configure a remote syslog destination, please reference the https://kb.juniper.net/InfoCenter/index?page=content&id=kb16502[SRX Getting Started - Configure System Logging].

The following processes and tags are supported:

[options="header"]
|==============================================================
| JunOS processes | JunOS tags                                |
| RT_FLOW         | RT_FLOW_SESSION_CREATE                    |
|                 | RT_FLOW_SESSION_CLOSE                     |
|                 | RT_FLOW_SESSION_DENY                      |
|                 | APPTRACK_SESSION_CREATE                   |
|                 | APPTRACK_SESSION_CLOSE                    |
|                 | APPTRACK_SESSION_VOL_UPDATE               |
| RT_IDS          | RT_SCREEN_TCP                             |
|                 | RT_SCREEN_UDP                             |
|                 | RT_SCREEN_ICMP                            |
|                 | RT_SCREEN_IP                              |
|                 | RT_SCREEN_TCP_DST_IP                      |
|                 | RT_SCREEN_TCP_SRC_IP                      |
| RT_UTM          | WEBFILTER_URL_PERMITTED                   |
|                 | WEBFILTER_URL_BLOCKED                     |
|                 | AV_VIRUS_DETECTED_MT                      |
|                 | CONTENT_FILTERING_BLOCKED_MT              |
|                 | ANTISPAM_SPAM_DETECTED_MT                 |
| RT_IDP          | IDP_ATTACK_LOG_EVENT                      |
|                 | IDP_APPDDOS_APP_STATE_EVENT               |
| RT_AAMW         | SRX_AAMW_ACTION_LOG                       |
|                 | AAMW_MALWARE_EVENT_LOG                    |
|                 | AAMW_HOST_INFECTED_EVENT_LOG              |
|                 | AAMW_ACTION_LOG                           |
| RT_SECINTEL     | SECINTEL_ACTION_LOG                       |
|==============================================================

The syslog format choosen should be `Default`.

[float]
=== Compatibility

This module has been tested against JunOS version 19.x and 20.x.
Versions above this are expected to work but have not been tested.

[source,yaml]
----
- module: junos
  firewall:
    enabled: true
    var.input: udp
    var.syslog_host: 0.0.0.0
    var.syslog_port: 9006
----

include::../include/var-paths.asciidoc[]

*`var.input`*::

The input to use, can be either the value `tcp`, `udp` or `file`.

*`var.syslog_host`*::

The interface to listen to all syslog traffic. Defaults to localhost.
Set to 0.0.0.0 to bind to all available interfaces.

*`var.syslog_port`*::

The port to listen for syslog traffic. Defaults to 9006.


[float]
==== Juniper SRX ECS fields

This is a list of JunOS fields that are mapped to ECS.

[options="header"]
|==============================================================
| Juniper SRX Fields         | ECS Fields                     |
| application-risk           | event.risk_score               |
| bytes-from-client          | source.bytes                   |
| bytes-from-server          | destination.bytes              |
| destination-interface-name | observer.egress.interface.name |
| destination-zone-name      | observer.egress.zone           |
| destination-address        | destination.ip                 |
| destination-port           | destination.port               |
| dst_domainname             | url.domain                     |
| elapsed-time               | event.duration                 |
| filename                   | file.name                      |
| nat-destination-address    | destination.nat.ip             |
| nat-destination-port       | destination.nat.port           |
| nat-source-address         | source.nat.ip                  |
| nat-source-port            | source.nat.port                |
| message                    | message                        |
| obj                        | url.path                       |
| packets-from-client        | source.packets                 |
| packets-from-server        | destination.packets            |
| policy-name                | rule.name                      |
| protocol                   | network.transport              |
| source-address             | source.ip                      |
| source-interface-name      | observer.ingress.interface.name|
| source-port                | source.port                    |
| source-zone-name           | observer.ingress.zone          |
| url                        | url.domain                     |
|==============================================================


:fileset_ex: junos

[float]
==== `junos` fileset settings

experimental[]

NOTE: This was converted from RSA NetWitness log parser XML "junosrouter" device revision 134.

*`var.input`*::

The input from which messages are read. One of `file`, `tcp` or `udp`. Defaults to `udp`.

*`var.syslog_host`*::

The address to listen to UDP or TCP based syslog traffic.
Defaults to `localhost`.
Set to `0.0.0.0` to bind to all available interfaces.

*`var.syslog_port`*::

The port to listen for syslog traffic. Defaults to `9513`

NOTE: Ports below 1024 require Filebeat to run as root.

*`var.tz_offset`*::

By default, datetimes in the logs will be interpreted as relative to
the timezone configured in the host where {beatname_uc} is running. If ingesting
logs from a host on a different timezone, use this field to set the timezone
offset so that datetimes are correctly parsed. Valid values are in the form
±HH:mm, for example, `-07:00` for `UTC-7`.

*`var.rsa_fields`*::

Flag to control the addition of non-ECS fields to the event. Defaults to true,
which causes both ECS and custom fields under `rsa` to be added.

*`var.keep_raw_fields`*::

Flag to control the addition of the raw parser fields to the event. This fields
will be found under `rsa.raw`. The default is false.

:has-dashboards!:

:fileset_ex!:

[float]
==== `netscreen` fileset settings

experimental[]

NOTE: This was converted from RSA NetWitness log parser XML "netscreen" device revision 134.

*`var.input`*::

The input from which messages are read. One of `file`, `tcp` or `udp`. Defaults to `udp`.

*`var.syslog_host`*::

The address to listen to UDP or TCP based syslog traffic.
Defaults to `localhost`.
Set to `0.0.0.0` to bind to all available interfaces.

*`var.syslog_port`*::

The port to listen for syslog traffic. Defaults to `9523`

NOTE: Ports below 1024 require Filebeat to run as root.

*`var.tz_offset`*::

By default, datetimes in the logs will be interpreted as relative to
the timezone configured in the host where {beatname_uc} is running. If ingesting
logs from a host on a different timezone, use this field to set the timezone
offset so that datetimes are correctly parsed. Valid values are in the form
±HH:mm, for example, `-07:00` for `UTC-7`.

*`var.rsa_fields`*::

Flag to control the addition of non-ECS fields to the event. Defaults to true,
which causes both ECS and custom fields under `rsa` to be added.

*`var.keep_raw_fields`*::

Flag to control the addition of the raw parser fields to the event. This fields
will be found under `rsa.raw`. The default is false.

:has-dashboards!:

:fileset_ex!:

:modulename!:

