WIXLIB

Data SheetJSA SERIES SECURE ANALYTICSProduct DescriptionJuniper Networks JSA Series Secure Analytics combine, analyze, and managean unparalleled set of surveillance data—network behavior, security events,vulnerability profiles, and threat information—to empower companies to efficientlymanage business operations on their networks from a single console.Product OverviewThe integrated approach of JSASeries Secure Analytics, used inconjunction with unparalleled datacollection, analysis, correlation,and auditing capabilities, enablesorganizations to quickly and easilyimplement a corporate-widesecurity management programthat delivers security bestpractices. These include superiorlog analytics with distributed logcollection and centralized viewing;threat analytics that provide realtime surveillance and detectioninformation; and compliancemanagement capabilities—allviewed and managed from a singleconsole. Log Analytics: JSA Series provides scalable log analytics by enabling distributedlog collection across an organization and a centralized view of the information. Threat Analytics: JSA Series provides an advanced network securitymanagement solution that bridges the gap between network and securityoperations to deliver real-time surveillance and detect complex IT-based threats. Compliance Management: JSA Series brings to enterprises, institutions, andagencies the accountability, transparency, and measurability—critical factors to thesuccess of any IT security program required to meet regulatory mandates. Vulnerability Management: Deployed as a standalone solution or working inconjunction with Threat Analytics, JSA Series can function as a full-featuredvulnerability scanner. Risk Management: JSA Series helps security professionals stay aheadof advanced threats by proactively quantifying risks from vulnerabilities,configuration errors and anomalous network activity, preventing attacks thattarget high-value assets and data. Security Director: The Junos Space Security Director application includes a “Block”button that, when clicked, automatically creates and deploys a firewall rule in theoptimal location within your rules base to remediate detected offenses.With preinstalled software, a hardened operating system, and a web-based setupprocess, the JSA Series lets you get your network security up and running quicklyand easily. The bottom line is simple deployment, fast implementation, and improvedsecurity, at a low total cost of ownership.Architecture and Key ComponentsJSA Secure Analytics AppliancesThe Juniper Networks Secure Analytics appliances provide a scalable solution forsecurity event management. The JSA7800 is an enterprise-class solution deployedas an all-in-one solution with integrated event collection, correlation and extensivereporting, or as a dedicated event and/or flow collector.JSA Virtual ApplianceJuniper Networks JSA Virtual Appliance (JSA VM) Secure Analytics is a virtualizedplatform that provides Secure Analytics functionality. JSA VM is designed to runwith VMWare ESX 5.0 and ESX 5.1, and requires a configuration with a minimumof two CPUs (1 socket x 2 cores or 2 sockets x 1 core) and 8GB of RAM. Itprocesses a maximum of 20,000 events per second or 600,000 flows per minute,with 16 cores and 24 GB of RAM.1

JSA Series Secure AnalyticsFeatures and BenefitsTable 1. JSA Series Secure Analytics Features and BenefitsFeaturesFeature DescriptionBenefitsAll-in-one appliancesEvent collection, flow collection event processing, flowprocessing, correlation, analysis, and reporting are allembedded within JSA Series Secure Analytics. All core functions are available within the system, making iteasy for users to deploy and manage in minutes.JSA Series can scale to large, distributed deployments that cansupport up to 5 million events per second. Users have the flexibility to scale to large deployments astheir business grows.Distributed support JSA Series architecture provides a streamlined solution forsecure and efficient log analytics. JSA Series can be easily deployed in large distributedenvironments.Security Director integrationJuniper Secure Analytics integrates with Junos Space SecurityDirector to block malicious IP addresses in an attack with asingle mouse click. Increases speed at which malware is blockedJSA Series utilizes SAS HDD in RAID 1, RAID 6, and RAID 10setups. SAS HDD is designed for 24x7 operations.Easy and quick installJSA Series comes with an easy, out-of-the-box setup wizard. Users can install and manage JSA Series appliances in acouple of steps.Automatic updatesSecure Analytics automatically downloads and deploysreputation feeds, parser updates, and patches. Users don’t need to worry about maintaining appliance andOS updates and patches.High availability (HA)Users can deploy all JSA Series appliances in HA mode Users can deploy JSA Series with full active/passiveredundancy to support all deployment scenarios, all-in-oneand distributed.Built-in compliance reportsOut-of-the-box compliance reports are included with the JSASeries. JSA Series provides 500 out-of-the-box compliancereports.Reporting and alerting capabilities forcontrol framework Control Objectives for Information and related Technology(CobiT) JSA Series enables repeatable compliance monitoring,reporting, and auditing processes.HDD implementation Reduces the expertise needed to harness the power of IBMQradar and Juniper Secure Analytics products RAID 1/10 implementation provides the best performanceand redundancy. International Organization for Standardization (ISO) ISO/IEC27002 (17799) Common Criteria (CC) (ISO/IEC 15408) NIST specialpublication 800-53 revision 1 and Federal InformationProcessing Standard (FIPS) 200Compliance-focused regulationworkflow Payment Card Industry Data Security Standard (PCI DSS) Health Insurance Portability and Accountability Act (HIPAA) Sarbanes-Oxley Act (SOX) Graham-Leach-Bliley Act (GLBA) JSA Series supports multiple regulations and security bestpractices. Includes compliance-driven report templates to meetspecific regulatory reporting and auditing requirements. Federal Information Security Management Act (FISMA)Management-level reports on overallsecurity stateThe JSA Series reports interface allows you to create,distribute, and manage reports generated in PDF, HTML, RTF,XML, or XLS formats. Users can use the report wizard to create executive andoperational level reports that combine network traffic andsecurity event data in a single report.One-stop supportJuniper Networks Technical Assistance Center (JTAC) supportsall aspects of the JSA Series. Users don’t need to go to several places to get support,even for multivendor issues.2

JSA Series Secure AnalyticsLog AnalyticsJSA Series provides a comprehensive log analytics framework that includes scalable and secure log analytics capabilities integratedwith real-time event correlation, policy monitoring, threat detection, and compliance reporting.Table 2. Log Analytics Features and BenefitsFeaturesFeature DescriptionBenefitsComprehensive log managementJSA Series delivers scalable and secure log analytics withstorage capabilities from GB to TB of data storage.Provides long-term collection, archival, search, and reportingof event logs, flow logs, and application data that enableslogging taxonomy from a centralized view.Comprehensive reportingJSA Series comes with 1,300 canned reports. Report Wizardallows users to customize and schedule daily, weekly, andmonthly reports that can be exported in PDF, HTML, RTF,Word, Excel, and XML formats.Provides users the convenience of canned reports and theflexibility to create and customize their reports according totheir business needs.Log management and reporting onlyoptionJSA Series provides a comprehensive log management andreporting solution with a distributed log analytics only solutionto collect, archive, customize, and analyze network securityevent logs.Allows users to start with a log management and reportingonly option and then upgrade to full-blown JSA Seriesfunctionality as their business need grows—without upgradingtheir existing hardware.Log retention and storageJSA Series database can easily archive logs and integratethem into an existing storage infrastructure for long-term logretention and hassle-free storage.Enables organizations to archive event and flow logs forwhatever time period is specified by a specific regulation.Tamper-proof data Event and flow logs are protected by SHA-x (1-256)hashing for tamper-proof log archives.Provides secure storage based on industry regulations. Support for extensive log file integrity checks including theNational Institute of Standards and Technology (NIST) logmanagement standards.Real-time event viewingData warehousingJSA Series allows users to monitor and investigate events inreal time or perform advanced searches. The event viewerindicates what events are correlated to offenses and whichare not. Users can quickly and effectively view and filter real-timeevents.JSA Series includes a purpose-built data warehouse for highspeed insertion and retrieval of data archive of all securitylogs, event logs, and network activity logs(flow logs).Enables full audit of all original events and flow contentwithout modification.Threat AnalyticsJSA Series Secure Analytics’ network security managementsolution takes an innovative approach to managing computerbased threats in the enterprise. Recognizing that discreteanalysis of security events is not enough to properly detectthreats, we developed the JSA Series to provide an integratedapproach to threat analytics that combines the use oftraditionally siloed information to more effectively detect andmanage today’s complex threats. Specific information that iscollected includes: Network Events: Events generated from networkedresources, including switches, routers, servers, anddesktops. Security Logs: Includes log data generated from securitydevices like firewalls, VPNs, intrusion detection/prevention, antivirus, identity management, andvulnerability scanners. Provides a flexible query engine that includes advancedaggregating capability and IT forensics. Host and Application Logs: Includes log data fromindustry-leading host operating systems (MicrosoftWindows, UNIX, and Linux) and from critical businessapplications (authentication, database, mail, and Web). Network and Application Flow Logs: Includes flow datagenerated by network devices and provides an ability tobuild network and protocol activity context. User and Asset Identity Information: Includesinformation from commonly used directories, includingActive Directory and Lightweight Directory AccessProtocol (LDAP). By incorporating patent pending“offense” management technology, this integratedinformation is normalized and correlated by the JSASeries, resulting in automated intelligence that quicklydetects, notifies, and responds to threats missed byother security solutions with isolated visibility.3