You want to be alerted if the wrong password is used more than three times on a single device within five minutes. Which Juniper Networks solution…

The scenario describes a classic Security Information and Event Management (SIEM) use case: correlating specific events (failed password attempts) from a device over a defined time window (five minutes) and triggering an alert when a threshold (three times) is met. Juniper Secure Analytics (JSA) is Juniper's SIEM and network security management platform. It is specifically designed to collect, process, and correlate event and flow data from disparate sources to detect and alert on threats, such as the brute-force or password-guessing activity described in the question.

A. Adaptive Threat Profiling: This feature dynamically creates and applies security policies based on threat feeds and user/device context for enforcement on SRX firewalls, rather than correlating log events for alerting.

C. Juniper Identity Management Service: JIMS collects and provides user identity information (e.g., user-to-IP mapping) to SRX devices for identity-based policies, but it does not perform event correlation or alerting.

D. Intrusion Prevention System: An IPS inspects network traffic in real-time to block known attack patterns (signatures). It does not perform the stateful, time-based correlation of system log events required by the scenario.

1. Juniper Secure Analytics (JSA): The official JSA documentation states

"Juniper Secure Analytics (JSA) is a network security management platform that provides a comprehensive view of your network's security posture... JSA uses a powerful rules engine to correlate security events and network flow data to detect and alert you to potential threats." This directly aligns with the question's requirement.

Source: Juniper Networks TechLibrary

"JSA Administration Guide

" Overview section.

2. Adaptive Threat Profiling: "Adaptive threat profiling enables the SRX Series Firewall to use threat feeds to stop threats at the firewall. You can create policies that use these feeds to block traffic from malicious hosts..." This describes policy enforcement

not event correlation.

Source: Juniper Networks TechLibrary

"Adaptive Threat Profiling Overview."

3. Juniper Identity Management Service (JIMS): "The Juniper Identity Management Service (JIMS) collects user identity information... and then provides the information to SRX Series devices

which use it to enforce identity-based security policies." This confirms its role is identity provision

not event analysis.

Source: Juniper Networks TechLibrary

"Juniper Identity Management Service (JIMS) Overview."

4. Intrusion Prevention System (IPS): "The Intrusion Prevention System (IPS) feature on SRX Series Firewalls provides protection against network- and application-level attacks by inspecting traffic for malicious patterns." This highlights its focus on real-time traffic inspection against signatures.

Source: Juniper Networks TechLibrary

"Intrusion Prevention System (IPS) for SRX Series Overview."