Configure Juniper Firewall Collection

Collecting Juniper Firewall logs enables Alert Logic to run our common firewall analytics on data from your Juniper Firewall devices. These analytics identify suspicious communication with internet hosts which Alert Logic considers threat actors. Significant security findings from your Juniper Firewall devices will result in the creation of incidents that can be managed in the Alert Logic console.

You must complete the following to send data from your Juniper Firewall device(s) to Alert Logic:

  1. Download and install the remote collector
  2. Configure Juniper Firewall device
  3. Verify log collection

Download and install the remote collector

To send data from your Juniper Firewall device(s) to Alert Logic, you must first download and install the remote collector in the same network as the Juniper Firewall device(s).

To download and install the remote collector:

  1. Review the requirements for the remote collector as outlined in Requirements for the Alert Logic Remote Collector and ensure all requirements are met.
  2. Complete the following instructions for Linux or Windows, making sure to choose a host in the same network as the Juniper Firewall device(s).
  3. While installing the remote collector, note the IP of the host where the collector is installed. This IP will be needed when configuring the Juniper Firewall device.

Configure Juniper Firewall device

Once the remote collector is installed, the Juniper Firewall device needs to be configured to send data to the collector.

To configure the Juniper Firewall device:

  1. Log into your SRX device's CLI. Your current configuration will be displayed on the screen.
  2. Configure the remote syslog server via the following commands:
    set system syslog host <IP of remote collector> any any
    set system syslog host <IP of remote collector> authorization any
    set system syslog host <IP of remote collector> port 1515
    set system syslog host <IP of remote collector> source-address <IP of firewall>
    set system syslog host <IP of remote collector> structured-data
    commit
  3. Run the following command to validate your inputs have been committed:
    run show configuration

Verify log collection

Once you have installed the remote collector and configured the Juniper Firewall device, it is recommended to verify that log collection is successful. It may take up to 15 minutes for Alert Logic to begin receiving logs.

  1. Log in to the Alert Logic console and use one of the following links to access the Search console with criteria already entered:
  2. Uncomment either of the two commented lines with SQL parameters and replace either $COLLECTOR_ID or $COLLECTOR_IP with your preferred identifier for the remote collector.
  3. Click Search.
  4. Verify logs display for the remote collector.