Transcription

Data SheetJSA SERIES SECURE ANALYTICSProduct DescriptionJuniper Networks JSA Series Secure Analytics combine, analyze, and managean unparalleled set of surveillance data—network behavior, security events,vulnerability profiles, and threat information—to empower companies to efficientlymanage business operations on their networks from a single console.Product OverviewThe integrated approach of JSASeries Secure Analytics, used inconjunction with unparalleled datacollection, analysis, correlation,and auditing capabilities, enablesorganizations to quickly and easilyimplement a corporate-widesecurity management programthat delivers security bestpractices. These include superiorlog analytics with distributed logcollection and centralized viewing;threat analytics that deliver realtime surveillance and detectioninformation; and compliancemanagement capabilities—allviewed and managed from a singleconsole. Log Analytics: JSA Series provides scalable log analytics by enabling distributedlog collection across an organization, and a centralized view of the information. Threat Analytics: JSA Series provides an advanced network securitymanagement solution that bridges the gap between network and securityoperations to deliver real-time surveillance and detect complex IT-based threats. Compliance Management: JSA Series brings to enterprises, institutions, andagencies the accountability, transparency, and measurability that are critical factorsto the success of any IT security program required to meet regulatory mandates. Vulnerability Management: Deployed as a standalone solution or working inconjunction with Threat Analytics, JSA Series can function as a full-featuredvulnerability scanner. Risk Management: JSA Series helps security professionals stay aheadof advanced threats by proactively quantifying risks from vulnerabilities,configuration errors and anomalous network activity, preventing attacks thattarget high value assets and data. Security Director: The Junos Space Security Director application includes a “Block”button that, when clicked, automatically creates and deploys a firewall rule in theoptimal location within your rules base to remediate detected offenses.With preinstalled software, a hardened operating system, and a web-basedsetup process, the JSA Series lets you get your network security up and runningquickly and easily. The bottom line of the JSA Series is simple deployment, fastimplementation, and improved security, at a low total cost of ownership.Architecture and Key ComponentsJSA Secure Analytics AppliancesThe Juniper Networks Secure Analytics appliances provide a scalable solution forsecurity event management. The JSA5800 and JSA7800 are enterprise-class solutionsthat can be deployed as an all-in-one solution with integrated event collection,correlation and extensive reporting, or as a dedicated event and/or flow collector.JSA Virtual ApplianceJuniper Networks JSA Virtual Appliance (JSA VM) Secure Analytics is a virtualizedplatform that provides Secure Analytics functionality. JSA VM is designed to runwith VMWare ESX 5.0 and ESX 5.1, and requires a configuration with a minimumof two CPUs (1 socket x 2 cores or 2 sockets x 1 core) and 8GB of RAM. Itprocesses a maximum of 20,000 events per second or 600,000 flows per minute,with 16 cores and 24 GB of RAM.1

JSA Series Secure AnalyticsFeatures and BenefitsTable 1. JSA Series Secure Analytics Features and BenefitsFeaturesFeature DescriptionBenefitsAll-in-one appliancesEvent collection, flow collection event processing, flowprocessing, correlation, analysis, and reporting are allembedded within JSA Series Secure Analytics. All core functions are available within the system and it iseasy for users to deploy and manage in minutes.JSA Series has the ability to scale to large distributeddeployments that can support up to 5 million events persecond. Users have the flexibility to scale to large deployments astheir business grows.Juniper Secure Analytics integrates with Junos Space SecurityDirector to block malicious IP addresses involved in an attackwith a single mouse click. Increases speed at which malware can be blockedJSA Series utilizes SAS HDD in RAID 1, RAID 6, and RAID 10setups. SAS HDD is designed for 24x7 operations.Easy and quick installJSA Series comes with an easy, out-of-the-box setup wizard. Users can install and manage JSA Series appliances in acouple of steps.Automatic updatesSecure Analytics automatically downloads and deploysreputation feeds, parser updates, and patches. Users don’t need to worry about maintaining appliance andOS updates and patches.High availability (HA)Users can deploy all JSA Series appliances in HA mode Users can deploy JSA Series with full active/passiveredundancy. This supports all deployment scenarios, all-inone and distributed.Built-in compliance reportsOut-of-the-box compliance reports are included with the JSASeries. JSA Series provides 500 out-of-the-box compliancereports.Reporting and alerting capabilities forcontrol framework Control Objectives for Information and related Technology(CobiT) JSA Series enables repeatable compliance monitoring,reporting, and auditing processes.Distributed supportSecurity Director integrationHDD implementation JSA Series architecture provides a streamlined solution forsecure and efficient log analytics. JSA Series can be easily deployed in large distributedenvironments. Reduces the expertise needed to harness the power of IBMQradar and Juniper Secure Analytics products RAID 1/10 implementation provides best possibleperformance and redundancy. International Organization for Standardization (ISO) ISO/IEC27002 (17799) Common Criteria (CC) (ISO/IEC 15408) NIST specialpublication 800-53 revision 1 and Federal InformationProcessing Standard (FIPS) 200Compliance-focused regulationworkflow Payment Card Industry Data Security Standard (PCI DSS) Health Insurance Portability and Accountability Act (HIPAA) Sarbanes-Oxley Act (SOX) Graham-Leach-Bliley Act (GLBA) JSA Series supports multiple regulations and security bestpractices. Includes compliance-driven report templates to meetspecific regulatory reporting and auditing requirements. Federal Information Security Management Act (FISMA)Management-level reports on overallsecurity stateThe JSA Series reports interface allows you to create,distribute, and manage reports that are generated in PDF,HTML, RTF, XML, or XLS formats. Users can use the report wizard to create executive andoperational level reports that combine any network trafficand security event data in a single report.One stop supportJuniper Networks Technical Assistance Center (JTAC) supportsall aspects of the JSA Series. Users don’t need to go to several places to get support,even for multivendor issues.2

JSA Series Secure AnalyticsLog AnalyticsJSA Series provides a comprehensive log analytics framework that includes scalable and secure log analytics capabilities integratedwith real-time event correlation, policy monitoring, threat detection, and compliance reporting.Table 2. Log Analytics Features and BenefitsFeaturesFeature DescriptionBenefitsComprehensive log managementJSA Series delivers scalable and secure log analytics withstorage capabilities from GB to TB of data storage.Provides long term collection, archival, search, and reportingof event logs, flow logs, and application data that enableslogging taxonomy from a centralized view.Comprehensive reportingJSA Series comes with 1,300 canned reports. Report Wizardallows users to customize and schedule daily, weekly, andmonthly reports that can be exported in PDF, HTML, RTF,Word, Excel, and XML formats.Provides users not only the convenience of canned reportsbut also the flexibility to create and customize their ownreports according to their business needs.Log management and reporting onlyoptionJSA Series provides a comprehensive log management andreporting solution with a distributed log analytics only solutionto collect, archive, customize, and analyze network securityevent logs.Allows users to start with a log management and reportingonly option and then upgrade to full blown JSA Seriesfunctionality as their business need grows—without upgradingtheir existing hardware.Log retention and storageJSA Series database can easily archive logs and integrate intoan existing storage infrastructure for long-term log retentionand hassle-free storage.Enables organizations to archive event and flow logs forwhatever time period is specified by a specific regulation.Tamperproof data Event and flow logs are protected by SHA-x (1-256)hashing for tamper proof log archives.Provides secure storage based on industry regulations. Support of extensive log file integrity checks includingNational Institute of Standards and Technology (NIST) logmanagement standards.Real-time event viewingData warehousingJSA Series allows users to monitor and investigate events inreal time or perform advanced searches. The event viewerindicates what events are being correlated to offenses andwhich are not. Users have the ability to quickly and effectively view andfilter real-time events.JSA Series includes a purpose-built data warehouse for highspeed insertion and retrieval of data archive of all securitylogs, event logs, and network activity logs(flow logs).Enables full audit of all original events and flow contentwithout modification.Threat AnalyticsJSA Series Secure Analytics’ network security managementsolution takes an innovative approach to managing computerbased threats in the enterprise. Recognizing that discreteanalysis of security events is not enough to properly detectthreats, the JSA Series was developed to provide an integratedapproach to threat analytics that combines the use oftraditionally siloed information to more effectively detect andmanage today’s complex threats. Specific information that iscollected includes: Network Events: Events generated from networkedresources, including switches, routers, servers, anddesktops. Security Logs: Includes log data generated from securitydevices like firewalls, VPNs, intrusion detection/prevention, antivirus, identity management, andvulnerability scanners. Provides a flexible query engine that includes advancedaggregating capability and IT forensics. Host and Application Logs: Includes log data fromindustry-leading host operating systems (MicrosoftWindows, UNIX, and Linux) and from critical businessapplications (authentication, database, mail, and Web). Network and Application Flow Logs: Includes flow datagenerated by network devices and provides an ability tobuild a context of network and protocol activity. User and Asset Identity Information: Includesinformation from commonly used directories, includingActive Directory and Lightweight Directory AccessProtocol (LDAP). By incorporating patent pending“offense” management technology, this integratedinformation is normalized and correlated by the JSASeries, resulting in automated intelligence that quicklydetects, notifies, and responds to threats missed byother security solutions with isolated visibility.3

JSA Series Secure AnalyticsTable 3. Threat Analytics Features and BenefitsFeaturesFeature DescriptionBenefitsOut-of-the-box correlation rulesJSA Series correlation rules allow users to detect specific orsequential event flows or offenses. A rule consists of tests andfunctions that perform a response when events match. Provides hundreds of out-of-the-box correlation rules thatprovide immediate value.The offense manager allows you to investigate offenses,behaviors, anomalies, targets, and attackers on your network.The JSA Series can correlate events and network activity withtargets located across multiple networks in the same offenseand ultimately the same network incident. This allows users to effectively investigate each offense intheir network.JSA Series associates or maps a normalized or raw event to ahigh-level and low-level category. Allows users to see real-time events mapped toappropriate categoriesOffense managementQID mappings Users can create their own rules by using the JSA Seriesrule wizard to generate automated alerts and enable realtime policy enforcement. Users can navigate the common interface to investigatethe event details to determine the unique events thatcaused the offense. This enables the mapping of unknown device events toknown JSA Series events in order to be categorized andcorrelated appropriately.Historical profilingJSA Series collects and stores entire event data for later use,enabling extensive use of historical profiling for improvedaccuracy. Allows users to view historical data at any given point aswell as views into incident management and the trackingof events.JSA Series magistrateJSA Series magistrate component prioritizes the offensesand assigns a magnitude value based on several factorsthat include the number of events, severity, relevance, andcredibility. Allows users to see prioritized security events rather thanlooking through thousands of log events.Offense manager APIJSA Series provides a set of open APIs to modify andconfigure incident management parameters like “create, close,and open.” Allows users to integrate third-party customer careapplications like Remedy and other ticketing solutions.Flow supportFlow support includes NetFlow, J-Flow, sFlow,and IPFIX Enables collection, visibility, and reporting of networktraffic. Enables users to see what events have the most impact ontheir business and respond quickly to threats. Includes Network Behavior Anomaly Detection (NBAD) todetect rough servers, and APTs based on network activity.Vulnerability ManagementAs a member of the JSA Series Secure Analytics network security management solution, Juniper Secure Analytics VulnerabilityManager helps organizations minimize the chances of a network security breach by proactively finding security weaknesses andmitigating potential risks. Using Juniper Secure Analytics Vulnerability Manager, organizations can perform rapid network scans,discover and highlight high-risk vulnerabilities from an integrated dashboard, and automate regulatory compliance through powerfulcollection, correlation and reporting tools.Table 4: Vulnerability Management Features and BenefitsFeaturesFeature DescriptionBenefitsVulnerability overviewJuniper Secure Analytics Vulnerability Manager maintains acurrent view of all discovered vulnerabilities, including detailssuch as when they were found, when they were last seen,what scan jobs reported them, and to whom the vulnerabilitywas assigned for remediation or mitigation.Provides the insight needed to make informed decisions.Vulnerability dashboardThe vulnerability dashboard provides a single, integratedview into multiple vulnerability assessment feeds and threatintelligence sources, allowing security teams to quickly identifyexposures that pose the greatest risks.Makes it easy to identify and prioritize vulnerabilities.Rapid network scansScans can be scheduled or performed dynamically to identifyand locate security weaknesses to minimize risks.Allows network vulnerabilities to be quickly found, analyzedand remediated.Automated regulatory complianceConducts regular network scans and maintains detailedaudit trails to facilitate compliance with federal or industryregulations.Makes compliance easy and automatic.4

JSA Series Secure AnalyticsRisk ManagementJuniper Secure Analytics Risk Manager is an integral component of a complete security intelligence solution, helping securityprofessionals detect and mitigate advanced threats. The ability to proactively quantify risk from vulnerabilities, configuration errors,anomalous network activity, and other outside threats can help organizations prevent exploits that target high-value assets and data.Table 5. Risk Management Features and BenefitsFeaturesFeature DescriptionBenefitsRisk Manager Topology ViewerEnables users to see network devices and their respectiverelationships, including subnets and links.Helps visualize current and potential network traffic patternswith a network topology model, based on security deviceconfigurations.Device configuration managementAutomates the collection, monitoring, and auditing of deviceconfigurations across an organization’s switches, routers,firewalls, and intrusion detection system/intrusion preventionsystem (IDS/IPS) devices.Provides centralized network security device management,reducing configuration errors and simplifying firewallperformance monitoring.Advanced investigative networktopology, traffic and forensics toolsTwo network visualization security tools provide unique,risk-focused, graphical representations of the network,providing network and security teams with critical vulnerabilityinformation before, during, and after an exploit.Quantifies and prioritizes risks with a policy engine thatcorrelates network topology, asset vulnerabilities, andactual network traffic, enabling risk-based remediation andfacilitating compliance.Compliance ManagementLicensingOrganizations of all sizes across almost every vertical marketface a growing set of requirements from IT security regulatorymandates. Recognizing that compliance with a policy orregulation will evolve over time, many industry expertsrecommend a compliance program that can demonstrate andbuild upon the following key factors:Secure Analytics is available in two different licensing options: Accountability: Providing surveillance that reports on whodid what and when Log Analytics: Enables event searching, custom dashboards,and scheduled reporting Threat Analytics: All log analytics features flow support,advanced correlation, and vulnerability assessmentIntegration Transparency: Providing visibility into the security controls,business applications, and assets that are being protected Measurability: Metrics and reporting around IT risksJSA5800JSA78005

JSA Series Secure AnalyticsJSA5800JSA7800Dimensions (W x H x D)17.2 x 3.5 x 24.8 in(43.7 x 8.9 x 63 cm)17.2 x 3.5 x 24.8 in(43.7 x 8.9 x 63 cm)Weight42 lb (19 kg)57 lb (25.85 kg)Rack mountable2U (rails and screws included)2U (rails and screws included)AC power supplyStandard: 920W high-efficiency (94% )AC-DC redundant power; support hot-swapAC Input: - 100-240 V, 50-60 Hz, 11-4.4 AmpStandard: 920W high-efficiency (94% )AC-DC redundant power; support hot-swapAC Input: - 100-240 V, 50-60 Hz, 11-4.4ADC power supplyOptional: 850W/1010W high-efficiency redundant DC toDC power supplySupport hot-swap.DC Input:Optional: 850W/1010W high-efficiency redundant DC toDC power supplySupport hot-swap850W: -36Vdc to -42Vdc, 30-25A1010W: -43 Vdc to -76 Vdc , 30 17Dimensions and Power 850W: -36Vdc to -42Vdc, 30-25A 1010W: -43 Vdc to -76 Vdc , 30 17Fans3 x 8 cm 9.5K RPM, 4-pin PWM fans3 x 8 cm 7K RPM, 4-pin PWM fansTraffic ports2x SFP 10GbE4x RJ-45 GbE2 x SFP 10GbE4 x RJ-45 GbEConsole port1 x RJ-45 DB9 serial console1 x RJ-45 DB9 serial consoleOperating temperature50 to 104 F (10 to 40 C)32 to 104 F (0 to 40 C)Storage temperature-40 to 158 F (-40 to 70 C)-40 to 158 F (-40 to 70 C)Relative humidity (operating)8 to 90 percent noncondensing5 to 90 percent noncondensingRelative humidity (storage)5 to 95 percent noncondensing5 to 95 percent noncondensingAltitude (operating)6,500 ft maximum6,500 ft maximumAltitude (storage)35,000 ft maximum35,000 ft maximumCSA 60950-1 Safety of Information Technology EquipmentCSA 60950-1 Safety of Information Technology Equipment UL 60950-1 UL 60950-1 EN 60950-1 EN 60950-1 IEC 60950-1 IEC 60950-1 47CFR Part 15, (FCC) Class A 47CFR Part 15, (FCC) Class A ICES-003 Class A ICES-003 Class A EN 55022 Class A EN 55022 Class A CISPR 22 Class A CISPR 22 Class A EN 55024 EN 55024 CISPR 24 CISPR 24 EN 300 386 EN 300 386 VCCI Class A VCCI Class A AS/NZA CISPR22 Class A AS/NZA CISPR22 Class A KN22 Class A KN22 Class A CNS13438 Class A CNS13438 Class A EN 61000-3-2 EN 61000-3-2 EN 61000-3-3 EN 61000-3-3WarrantyHardware on