Juniper Srx

LogZilla App Store application: Juniper Srx

Overview

Juniper SRX is a line of network security devices that combines firewall, intrusion prevention, and unified threat management capabilities. The SRX series runs JunOS and provides session flow logging for network traffic analysis and security monitoring.

App Function

  • Parse JunOS structured and unstructured syslog messages
  • Extract network flow metadata (IPs, ports, zones, policies)
  • Categorize events by message type and action
  • Map security events to MITRE ATT&CK framework
  • Provide dashboards for traffic analysis and security monitoring

Structured Messages

Recognizes JunOS message types via MSGID field in RFC 5424 structured data. Sets appropriate user tags for fields contained in each message type.

Unstructured Messages

Parses session-related events (RT_FLOW_SESSION_CREATE, RT_FLOW_SESSION_CLOSE, RT_FLOW_SESSION_DENY) from BSD-style syslog. Reformats messages into key/value pairs for readability.

Vendor Documentation

Device Configuration

Configure the SRX to send syslog messages to LogZilla:

  1. Log into the SRX via CLI or J-Web

  2. Configure a syslog host:

    text
    set system syslog host <logzilla-ip> any any
set system syslog host <logzilla-ip> port 514

  3. For structured syslog (recommended):

    text
    set system syslog host <logzilla-ip> structured-data

  4. Commit the configuration:

    text
    commit

Verification

Generate traffic or trigger a policy match, then verify events appear in LogZilla with Vendor: Juniper and Product: SRX tags.

Log Source Details

ItemValue
VendorJuniper Networks
Device TypeRouters, switches, and security devices running JunOS
Supported Software Version(s)JunOS 11.x and newer (tested on SRX-series firewalls)
Collection MethodSyslog
Configurable Log Output?Partially – JunOS supports both structured and unstructured syslog formats
Log Source TypeJunOS syslog
ExceptionsN/A

Incoming Log Format

Juniper JunOS devices generate syslog messages in two distinct formats:

Structured Format: Uses structured data elements with key-value pairs enclosed in brackets, following RFC 5424 structured data format.

Unstructured Format: Uses space-separated fields in a fixed order, primarily for session flow events.

Both formats are processed by the Juniper app to extract relevant security and network flow information.

Supported Log Types

Supported Structured Message Types

The app recognizes the following JunOS message types (MSGID):

  • SECINTEL_SERVICE_MANAGEMENT
  • AAMWD_NETWORK_CONNECT_FAILED
  • APPTRACK_SESSION_CREATE
  • APPTRACK_SESSION_CLOSE
  • LIBJSNMP_NS_LOG_WARNING
  • RTLOG_CONN_ERROR
  • LICENSE_EXPIRED_KEY_DELETED
  • UI_NETCONF_CMD
  • UI_CHILD_START
  • UI_CHILD_STATUS
  • RT_FLOW_SESSION_CREATE
  • RT_FLOW_SESSION_CLOSE
  • RT_FLOW_SESSION_DENY

Supported Unstructured Message Types

Session-related events (RT_FLOW_SESSION_CREATE, RT_FLOW_SESSION_CLOSE, RT_FLOW_SESSION_DENY) output as space-separated fields (see log examples below).

Parsed Metadata Fields

The following user tags are extracted from structured messages:

Tag NameExampleDescription
Event ClassnetworkCross-vendor event classification
SrcIP11.22.33.44Source IP address
DstIP55.66.77.88Destination IP address
DstPortHTTPSDestination port with service name
PolicyPolicyEnforcer-Rule1-1Security policy name
ReasonICMP errorSession close or deny reason
ActionCLOSESession action type
Message TypeRT_FLOW_SESSION_CLOSEJunOS message type identifier
Servicejunos-httpJunOS service name
ProtocolTCPNetwork protocol name
Source ZonetrustSource security zone
Destination ZoneuntrustDestination security zone
UseradminUsername associated with session
MitreIdT1071MITRE ATT&CK technique ID (DENY events)
MITRE TacticCommand and ControlMITRE ATT&CK tactic

Unstructured Message Tags

Unstructured messages are reformatted into key/value pairs. The following user tags are extracted:

Tag NameExampleDescription
Event ClassnetworkCross-vendor event classification
Message TypeRT_FLOW_SESSION_CLOSEJunOS message type identifier
ActionCLOSESession action type
SrcIP11.22.33.44Source IP address
DstIP55.66.77.88Destination IP address
DstPortdynamicDestination port with service name
Policy13101705Security policy name
ProtocolTCPNetwork protocol name
Source ZoneDMZ_OneSource security zone
Destination ZoneDMZ_TwoDestination security zone
Servicejunos-telnetJunOS service name (DENY events)
ReasonTCP SERVER RSTSession close reason

Log Examples

Structured Message - Session Close

text
2018-07-13T09:49:21.734Z TESTER RT_FLOW - RT_FLOW_SESSION_CLOSE
[[email protected] reason="ICMP error" source-address="11.22.33.44"
source-port="1298" destination-address="55.66.77.88"
destination-port="53" service-name="None"
nat-source-address="11.22.33.44" nat-source-port="8325"
nat-destination-address="55.66.77.88" nat-destination-port="53"
src-nat-rule-type="source rule" src-nat-rule-name="source-nat-rule"
dst-nat-rule-type="N/A" dst-nat-rule-name="N/A" protocol-id="6"
policy-name="PolicyEnforcer-Rule1-1" source-zone-name="trust"
destination-zone-name="untrust" session-id-32="20267666"
packets-from-client="1" bytes-from-client="64" packets-from-server="0"
bytes-from-server="0" elapsed-time="1" application="INCONCLUSIVE"
nested-application="INCONCLUSIVE" username="N/A" roles="N/A"
packet-incoming-interface="ge-0/0/1.0" encrypted="UNKNOWN"]

Structured Message - Network Connect Failed

text
2024-06-01T12:34:56.789Z TESTER AAMWD - AAMWD_NETWORK_CONNECT_FAILED
[[email protected] severity="2" proxy-port="None" proxy-address="None"
ip-address="11.22.33.44" hostname="host1.us-west-1.company.net"
error-message="Unauthorized" destination-port="443"] <2> Access host
srxapi.eu-west-1.sky.junipersecurity.net on ip 52.210.70.159 port 443 proxy
None port None Unauthorized.

Unstructured Message - Session Close

text
RT_FLOW_SESSION_CLOSE: session closed TCP SERVER
RST: 11.22.33.44/50488->55.66.77.88/48001 None
11.22.33.44/50488->55.66.77.88/48001 N/A N/A N/A N/A 6
13101705 DMZ_One DMZ_Two 120095417 16(8769) 15(1262) 2
UNKNOWN UNKNOWN N/A(N/A) reth8.1122 UNKNOWN

Unstructured Message - Session Denied

text
RT_FLOW_SESSION_DENY: session denied
11.22.33.44/36619->55.66.77.88/23 junos-telnet 6(0)
default-deny-log untrust DMZ_TESTONE UNKNOWN UNKNOWN N/A(N/A)
reth8.88 UNKNOWN policy deny

MITRE ATT&CK Mapping

Session deny events are mapped to MITRE ATT&CK techniques:

Event TypeMITRE IDTacticDescription
RT_FLOW_SESSION_DENYT1071Command and ControlBlocked network traffic

Dashboards

One dashboard is included:

  • Juniper SRX: Firewall Overview - Security events, MITRE tactics, session counts, top sources/destinations, policies, and denied sessions

Triggers

TriggerDescription
Juniper SRX: MITRE ATT&CK Threat DetectedCatch-all for blocked traffic
Juniper SRX: Session DeniedFirewall blocked traffic
Juniper SRX: User AuthenticationUser authentication events
Juniper Srx | LogZilla Documentation