The following table identifies the specifications for the Universal CEF DSM:
Table 1: Universal CEF DSM Specifications
RPM file name
Recorded event types
Includes custom properties?
To send events from a device that generates CEF-formatted events to JSA, complete the following steps:
If automatic updates are not enabled, download and install the most recent version of the following RPMs on your JSA console:
Universal CEF RPM
Add a Universal CEF log source on the JSA Console. Use the following values that are specific to Universal CEF:
Log Source Type
Syslog or Log File
Configure your third-party device to send events to JSA. For more information about how to configure your third-party device, see your vendor documentation.
Configure event mapping for Universal CEF events.
The JSA DSM for Universal CEF accepts events from any device that produces events in the Common Event Format (CEF).
Configuring Event Mapping for Universal CEF Events
Universal CEF events do not contain a predefined JSA Identifier (QID) map to categorize security events. You must search for unknown events from the Universal CEF log source and map them to high and low-level categories.
Ensure that you installed the Universal CEF DSM and added log source for it in JSA.
By default, the Universal CEF DSM categorizes all events as unknown. All Universal CEF events display a value of unknown in the Event Name and Low Level Category columns on the Log Activity tab. You must modify the QID map to individually map each event for your device to an event category in JSA. Mapping events allows JSA to identify, coalesce, and track events from your network devices.
For more information about event mapping, see the Juniper Secure Analytics Users Guide.
- Log in to JSA.
- Click the Log Activity tab.
- Click Add Filter.
- From the first list, select Log Source.
- From the Log Source Group list, select Other.
- From the Log Source list, select your Universal CEF log source.
- Click Add Filter.
- From the View list, select Last Hour.
- Click Save Criteria to save your existing search filter.
- On the Event Name column, double-click an unknown event for your Universal CEF DSM.
- Click Map Event.
- From the Browse for QID pane, select any of the following
search options to narrow the event categories
for a JSA Identifier (QID):
From the High-Level Category list, select a high-level event category. For a full list of high-level and low-level event categories or category definitions, see the Event Categories section of the Juniper Secure Analytics Administration Guide.
From the Low-Level Category list, select a low-level event category.
From the Log Source Type list, select a log source type.
Searching for QIDs by log source is useful when the events from your Universal CEF DSM are similar to another existing network device. For example, if your Universal CEF provides firewall events, you might select Cisco ASA, as another firewall product that likely captures similar events.
To search for a QID by name, type a name in the QID/Name field.
- Click Search.
- Select the QID that you want to associate to your unknown Universal CEF DSM event and click OK.