Contributing Questions for Possible Communication Tests

Detects assets that have possible communications to or from any specified source or destination. For example, to determine whether a critical server can possibly receive communications from any source, configure the test as follows:

have accepted communication from any source.

You can then apply a restrictive test to return if that critical server received any communications on port 21. Run this test to detect out-of-policy communications for that critical server.

Detects assets that have possible communications to or from the configured network.

Run this test to define a start or end point to your question.

For example, to identify the assets that have the possibility of communicating to the DMZ, configure the test as follows:

have accepted communication from source <networks>.

You can use this test to detect out-of-policy communications.

Detects assets that have possible communications to or from the configured IP address. Run this test to specify a single IP address as a focus for possible communications. For example, if you want to identify all assets that can communicate to a specific compliance server, configure the test as follows:

have accepted communications to destination <compliance server IP address>

Detects assets that have possible communications to or from the configured asset by using building blocks. Run this test to reuse building blocks defined in the JSA Rules Wizard in your query. For example, if you want to identify all assets that can communicate to a Protected Assets, configure the test as follows:

have accepted communications to destination <BB:HostDefinition:Protected Assets>

For more information about rules and building blocks, see the Juniper Secure Analytics Administration Guide.

Detects assets that have accepted communications to or from the assets that are returned by the saved search that you specify.

A saved asset search must exist before you use this test. For more information about creating and saving an asset search, see the Juniper Secure Analytics Users Guide.

Detects if source or destination communications are possible to or from the Internet.

Specify the to or from parameter to consider communication traffic to the Internet or from the Internet.

Detects possible specific vulnerabilities.

If you want to detect vulnerabilities of a particular type, use the test, are susceptible to vulnerabilities with one of the following classifications.

Specify the vulnerabilities to which you want this test to apply. You can search for vulnerabilities by using the OSVDB ID, CVE ID, Bugtraq ID, or title.

A vulnerability can be associated with one or more vulnerability classifications. This test filters all assets that have possible vulnerabilities with a Common Vulnerability Scoring System (CVSS) score, as specified.

Configure the classifications parameter to identify the vulnerability classifications that you want this test to apply.

A Common Vulnerability Scoring System (CVSS) value is an industry standard for assessing the severity of possible vulnerabilities. CVSS is composed of three metric groups: Base, Temporal, and Environmental. These metrics allow CVSS to define and communicate the fundamental characteristics of a vulnerability.

This test filters assets in your network that include the configured CVSS value.

Filters assets in your network with a possible vulnerability that is associated with the configured ports.

Configure the ports parameter to identify assets that have possible vulnerabilities based on the specified port number.

Detects assets in your network with a vulnerability that matches the asset name, vendor, version, or service based one or more text entries.

Configure the text entries parameter to identify the asset name, vendor, version, or service you want this test to consider.

Detects assets in your network with a vulnerability that matches the asset name, vendor, version, or service based one or more regular expressions.

Configure the regular expressions parameter to identify the asset name, vendor, version, or service you want this test to consider.