set services advanced-anti-malware policy

Syntax

Release Information

Command introduced in Junos OS Release 15.1X49-D33.

Description

The connection to the Juniper Sky Advanced Threat Prevention cloud is launched on-demand. It is established only when a condition is met and a file or URL must be sent to the cloud. The cloud inspects the file and returns a verdict number (1 through 10). A verdict number is a score or threat level. The higher the number, the higher the malware threat. The SRX Series device compares this verdict number to the Juniper Sky Advanced Threat Prevention policy settings and either permits or denies the session. If the session is denied, a reset packet is sent to the client and the packets are dropped from the server.

Juniper Sky Advanced Threat Prevention policies append to the Junos OS security policies by defining the actions to take when a file is considered malware or when an attempt is made to download a file from a location that’s on a custom blacklist or whitelist.

Use this command to configure the Juniper Sky Advanced Threat Prevention policy.

Options

policy-name—Name of the Juniper Sky Advanced Threat Prevention policy.

Note

Starting in Junos OS Release 18.2R1, for unified policies, a default-policy can be used for anti-malware and security-intelligence policies. The commands are: set services security-intelligence default-policy and set services advanced-anti-malware default-policy. During the initial policy lookup phase, which occurs prior to a dynamic application being identified, if there are multiple policies present in the potential policy list which contains different security intelligence or anti-malware policies, the SRX Series device applies the default policy until a more explicit match has occurred. See the Juniper Sky ATP Administration Guide and your SRX Series documentation for more details on unified policies.

blacklist-notification—(Optional) Create a system log entry when an attempt to access a website listed in the blacklist file is made. Use blacklist-notification log to create a log entry. If you do not want to create a log entry, do not specify the blacklist-notification option.

default-notification—Create a system log entry if the cloud returns a verdict number less than the verdict-threshold. Use default-notification log to create a log entry. If you do not want to create a log entry, do not specify the default-notification option.

fallback-options (action block | action permit)—The action to take when the SRX Series device runs out of resources or the connection to the cloud is lost. The default is action permit.

fallback-options—(Optional) Create a system log entry when fallback occurs. Use fallback-options notification log to create a log entry. If you do not want to create a log entry, do not specify the fallback-options notification option.

http(s) client-notify (message | file | redirect-url)—(Starting in Junos OS release 19.3R1) This command allows you to configure HTTP URL redirection for a customized client notification based on detected malware with the block action.

http(s) file-verdict-unknown (permit | block)—(Starting in Junos 19.3R1) This command allows you to permit or block malware based on the detected malware having a verdict of “unknown.” By default, “unknown” malware is permitted.

inspection-profile—Name of the Juniper Sky Advanced Threat Prevention profile. This profile defines what file types or file categories are to be sent to the cloud for inspection.

match verdict-threshold—The verdict-threshold defines the number at which you want to label a file as malware. For example, if you set verdict-threshold to 7 and the cloud returns a verdict number of 7 or greater, then that file is considered malware. verdict-threshold can be any number between 1 and 10, inclusive.

then notification—(Optional) Create a system log entry if the cloud returns a verdict number equal to or greater than the verdict-threshold. Use then notification log to create a log entry. If you do not want to create a log entry, do not specify the then notification option.

whitelist-notification—(Optional) Create a system log entry when an attempt to access a website listed in the whitelist file is made. Use whitelist-notification log to create a log entry. If you do not want to create a log entry, do not specify the whitelist-notification option.

Table 1 shows examples of using the Juniper Sky Advanced Threat Prevention policy options.

Table 1: Juniper Sky Advanced Threat Prevention Security Policy Additions

Addition	Description
Action and notification based on the verdict number and threshold	Defines the threshold value and what to do when the verdict number is greater than or equal to the threshold. For example, if the threshold is 7 and Juniper Sky Advanced Threat Prevention returns a verdict number of 9 for a file, then that file is blocked from being downloaded and a log entry is created. set services advanced-anti-malware policy aamwpol1 match verdict-threshold 7 set services advanced-anti-malware policy aamwpol1 then action block set services advanced-anti-malware policy aamwpol1 then notification log
Default action and notification	Defines what to do when the verdict number is less than the threshold. For example, if the threshold is 7 and Juniper Sky Advanced Threat Prevention returns a verdict number of 3 for a file, then that file is allowed to be downloaded and create a log entry. set services advanced-anti-malware policy aamwpol1 default-notification log
Name of the inspection profile	Name of the Juniper Sky Advanced Threat Prevention profile that defines the types of file to scan. set services advanced-anti-malware policy aamwpol1 inspection-profile profile1
Fallback options	Defines what to do when error conditions occur or when there is a lack of resources. The following fallback options are available: action—Permit or block the file regardless of its threat level. notification—Add or do not add this event to the log file. set services advanced-anti-malware policy aamwpol1 fallback-options action block set services advanced-anti-malware policy aamwpol1 fallback-options notification log
Blacklist notification	Defines whether to create a log entry when attempting to download a file from a site listed in the blacklist file. set services advanced-anti-malware policy aamwpol1 blacklist-notification log
Whitelist notification	Defines whether to create a log entry when attempting to download a file from a site listed in the whitelist file. set services advanced-anti-malware policy aamwpol1 whitelist-notification log
User notification of malware on block action	(Starting in Junos 19.3R1) This command allows you to configure HTTP and HTTPS URL redirection for a customized client notification based on detected malware with the block action. A block message can only be sent when a block action is configured. Note: See request services advanced-anti-malware redirect-file for details on adding a custom file. set services advanced-anti-malware policy p1 http client-notify message set services advanced-anti-malware policy p1 http client-notify file set services advanced-anti-malware policy p1 http client-notify redirect-url <enter URL>
Block or permit malware when file verdict is “unknown”	(Starting in Junos 19.3R1) This command allows you to permit or block malware based on the detected file having a verdict of “unknown.” By default, an “unknown” file verdict is permitted. (Note this only applies to HTTP and HTTPS traffic.) set services advanced-anti-malware policy p1 http file-verdict-unknown <block\|permit>

Additional Information

The easiest way to verify that the policy is working as expected is to test data traffic. You can also inspect the SRX session table:

Use the show services advanced-anti-malware policy CLI command to view your Juniper Sky Advanced Threat Prevention policy settings.

Required Privilege Level

view