JSA
The JSA 7.5.0 family of products includes the following enhancements to operational efficiency and flow improvements.
Enhancements to Operational Efficiency
-
More secure operating system––JSA 7.5.0 runs on Red Hat Enterprise Linux version 7.9. The upgrade to RHEL V7.9 is necessary to continue receiving security updates from Red Hat Enterprise Linux.
-
OFFENSE_TIME function––In JSA 7.5.0, use the new OFFENSE_TIME function to increase the speed of your offense queries.
The OFFENSE_TIME function limits the query to applicable times that an offense might be active.
For example, if you want to query for an offense within a time range, use the OFFENSE_TIME function together with the IN_OFFENSE function to limit the query to the times that the offense might have occurred.
SELECT * FROM events WHERE INOFFENSE(1) times OFFENSE_TIME(1)
For more information about AQL data retrieval functions, see the Juniper Secure Analytics Ariel Query Language (AQL) Guide.
-
DISTINCTCOUNT function––In JSA 7.5.0, use the new DISTINCTCOUNT function to return the unique count of the value in the aggregate.
The DISTINCTCOUNT function uses the HyperLogLog+ approximation algorithm to calculate the unique count and operates with a constant memory requirement. The function supports unlimited data sets.
For example,
SELECT username, DISTINCTCOUNTCOUNT(sourceip) AS CountSrcIP FROM events GROUP BY username
For more information about AQL data aggregation functions, see the Juniper Secure Analytics Ariel Query Language (AQL) Guide.
-
Encryption of managed hosts enabled by default––To provide secure data transfer between each of the appliances in your environment, JSA integrates encryption support that uses OpenSSH. In JSA 7.5.0, encryption between managed hosts is enabled by default when you add a managed host. Previously, you were required to manually enable encryption when you added a managed host.
For more information about encryption of managed hosts, see the Juniper Secure Analytics Administration Guide.