I85PREP
⌘ K
JNCIP-SEC study materials
JNCIP-SEC study resources

JNCIP-SEC: Automated Threat Mitigation

JNCIP-SEC · Work through your exam, one topic at a time.

All guide sections

Automated Threat Mitigation

Automated threat mitigation is the SRX acting on its own verdicts: identify the application, inspect the content, consult cloud intelligence, then permit, block or log without an administrator editing a rule for each indicator.

Core rules

  • Enforcement still hangs off the security policy: permitted traffic must reference inspection profiles in then permit application-services. A UTM or anti-malware policy that is configured but unattached inspects nothing.
  • AppSecure/AppID classifies traffic first; UTM then applies anti-virus, anti-spam, web filtering, content filtering and IPS profiles to permitted sessions.
  • Juniper ATP Cloud (advanced anti-malware) adds cloud verdicts: hashes and files are submitted and the returned verdict drives permit, block or a quarantine-style action. The device is enrolled with a registration token and checked with show services advanced-anti-malware status.
  • SecIntel feeds deliver command-and-control IP and DNS blocklists that the SRX consumes automatically, so a newly identified C&C address is blocked without a policy change.
  • Encrypted Traffic Insights infers malicious intent from TLS handshake metadata without decryption, which matters because TLS 1.3 and pinned certificates make decryption impractical.
  • Adaptive threat profiling watches for hosts showing suspicious behaviour and feeds those addresses back into enforcement.
  • Verification: show security policies hit-count, show security flow session, show log messages, and the anti-malware statistics.

Worked example

A user downloads a file over HTTP. The policy permits with an advanced-anti-malware profile; the SRX computes the hash, ATP Cloud returns a malicious verdict, and the session is blocked with a log entry naming that verdict. Minutes later the host tries the C&C IP from the payload; SecIntel already blocks it, so the second event needed no administrator action.

Traps

  • Enabling every inspection feature on a branch box and exhausting memory; sessions then fail for resource reasons.
  • Confusing log-only mode with blocking mode.
  • Assuming the first download is always blocked; verdict caching and unknown-file scoring can let the first attempt through.
  • Believing anti-virus inspects TLS 1.3 without decryption or ETI.
  • Leaving the profile unattached to the policy.