Glossary of Terms
Alternate Exhaust Interface
An eth2 interface configured (optionally) to contain analysis engine CnC traffic off the management network (eth0).
A Juniper ATP Appliance Advanced Threat Analytics (ATA) feature that allows for more detailed endpoint and log ingestion handling, management and reporting; includes Active Directory, Splunk and Direct Log Ingestion options.
Amazon Web Services and EC2 management console from which Juniper ATP Appliance administrators can configure vCore AMI images.
A list or register of entities to be denied a specified access or privilege. During detection engine analysis, when content matches any pattern on the blacklist, the content is deemed malicious and therefore an alert or block action is enacted immediately.
Juniper ATP Appliance’s Traffic inspection and object collection mechanism
Command and control server that directs the operation of a botnet.
Command-line interface. The Juniper ATP Appliance has a CLI interface for administering the appliance.
The Juniper ATP Appliance Central Manager component that has a web-based graphical user interface.
Currently unused address space.
Dynamic Host Configuration Protocol.
Demilitarized zone. An area of the network where systems have direct access to the Internet or an external network.
Domain Name Service.
Indicates a type of security intrusion or attack.
Greylists provide control over the priority of workorders for known IP addresses and URLs. Greylists contain files that contain either URLs or IP addresses and are used by the Juniper ATP Appliance analysis engines to check if the specified URLs or IP addresses contain a malicious rule match.
Graphical user interface. The Juniper ATP Appliance uses a web-based GUI for managing the appliance.
Known botnet server bot command
Events that are triggered when the appliance sees any of the common IRC bot commands or detects any communication sent to known botnet servers.
East-west detection of malware within the enterprise spread from endpoint host to host.
Malicious software used by attackers to disrupt, control, steal, cause data loss, spy upon, or gain unauthorized access to computer systems.
Network Time Protocol.
Events that indicate modification of the operating system.
Open Shortest Path First. A protocol that computes an optimal path for traffic in a TCP/IP network.
A mode in which malware is permitted to run, but results of the malware action are restricted to the virtual machine and not permitted to escape.
Simple Network Management Protocol.
A type of malware installed on computers that collects small pieces of information about user(s) it is spying on.
Secure Sockets Layer.
Transport Layer Security.
Virtual Local Area Network.
Virtual Machine. A software program that runs an instance of an operating system. The operating system runs on top of a program that emulates a hardware system.
A self-replicating malware program that uses a computer network to send copies of itself to other computers. This may be done without any user intervention.
An attack by malware that exploits unknown or newly discovered vulnerabilities in software before they become known or before security patches are applied to fix them