Help Center User GuideWhat's New
User Guide
What's New

Juniper Advanced Threat Prevention Cloud

About Juniper Advanced Threat Prevention Cloud

Juniper® Advanced Threat Prevention Cloud (Juniper ATP Cloud)is a security framework that protects all hosts in your network against evolving security threats by employing cloud-based threat detection software with a next-generation firewall system. See Figure 1.

Figure 1: Juniper ATP Cloud Overview

Juniper ATP Cloud Overview

Juniper ATP Cloud protects your network by performing the following tasks:

Juniper ATP Cloud supports the following modes:

Juniper ATP Cloud Features

Juniper ATP Cloud is a cloud-based solution. Cloud environments are flexible and scalable, and a shared environment ensures that everyone benefits from new threat intelligence in near real-time. Your sensitive data is secured even though it is in a cloud shared environment. Security analysts can update their defense when new attack techniques are discovered and distribute the threat intelligence with very little delay.

In addition, Juniper ATP Cloud offers the following features:

Figure 2 lists the Juniper ATP Cloud components.

Figure 2: Juniper ATP Cloud Components

Juniper ATP Cloud Components

Table 3 briefly describes each Juniper ATP Cloud component’s operation.

Table 3: Juniper ATP Cloud Components



Command and control (C&C) cloud feeds

C&C feeds are essentially a list of servers that are known command and control for botnets. The list also includes servers that are known sources for malware downloads.

GeoIP cloud feeds

GeoIP feeds is an up-to-date mapping of IP addresses to geographical regions. This gives you the ability to filter traffic to and from specific geographies in the world.

Infected host cloud feeds

Infected hosts indicate local devices that are potentially compromised because they appear to be part of a C&C network or other exhibit other symptoms.

Allowlist, blocklists and custom cloud feeds

A allowlist is simply a list of known IP addresses that you trust and a blocklist is a list that you do not trust.

Note: Custom feeds are not supported in this release.

SRX Series device

Submits extracted file content for analysis and detected C&C hits inside the customer network.

Performs inline blocking based on verdicts from the analysis cluster.

Malware inspection pipeline

Performs malware analysis and threat detection.

Internal compromise detection

Inspects files, metadata, and other information.

Service portal (Web UI)

Graphics interface displaying information about detected threats inside the customer network.

Configuration management tool where customers can fine-tune which file categories can be submitted into the cloud for processing.

How the SRX Series Device Remediates Traffic

The SRX Series devices use intelligence provided by Juniper ATP Cloud to remediate malicious content through the use of security policies. If configured, security policies block that content before it is delivered to the destination address.

For inbound traffic, security policies on the SRX Series device look for specific types of files, like .exe files, to inspect. When one is encountered, the security policy sends the file to the Juniper ATP Cloud cloud for inspection. The SRX Series device holds the last few KB of the file from the destination client while Juniper ATP Cloud checks if this file has already been analyzed. If so, a verdict is returned and the file is either sent to the client or blocked depending on the file’s threat level and the user-defined policy in place. If the cloud has not inspected this file before, the file is sent to the client while Juniper ATP Cloud performs an exhaustive analysis. If the file’s threat level indicates malware (and depending on the user-defined configurations) the client system is marked as an infected host and blocked from outbound traffic. For more information, see How is Malware Analyzed and Detected?.

Figure 3 shows an example flow of a client requesting a file download with Juniper ATP Cloud.

Figure 3: Inspecting Inbound Files for Malware

Inspecting Inbound Files for




A client system behind an SRX Series devices requests a file download from the Internet. The SRX Series device forwards that request to the appropriate server.


The SRX Series device receives the downloaded file and checks its security profile to see if any additional action must be performed.


The downloaded file type is on the list of files that must be inspected and is sent to the cloud for analysis.


Juniper ATP Cloud has inspected this file before and has the analysis stored in cache. In this example, the file is not malware and the verdict is sent back to the SRX Series device.


Based on user-defined policies and because this file is not malware, the SRX Series device sends the file to the client.

For outbound traffic, the SRX Series device monitors traffic that matches C&C feeds it receives, blocks these C&C requests, and reports them to Juniper ATP Cloud. A list of infected hosts is available so that the SRX Series device can block inbound and outbound traffic.

Juniper ATP Cloud Use Cases

Juniper ATP Cloud can be used anywhere in an SRX Series deployment. See Figure 4.

Figure 4: Juniper ATP Cloud Use Cases

Juniper ATP Cloud Use Cases


Juniper ATP Cloud has three service levels: Free, Basic (feed only), and Premium. No license is required for the free version, but you must obtain a license for Basic and Premium levels.

To understand more about Juniper ATP Cloud licenses, see Licenses for Juniper Advanced Threat Prevention (ATP) Cloud. Please refer to the Licensing Guide for general information about License Management. Please refer to the product Data Sheets for further details, or contact your Juniper Account Team or Juniper Partner.

Help us to improve. Rate this article.
Feedback Received. Thank You!

Ask questions in TechWiki

Check documentation in TechLibrary

Rating by you:      

Additional Comments

800 characters remaining

May we contact you if necessary?


Need product assistance? Contact Juniper Support