Network

Juniper SRX Firewall

Juniper SRX series security gateway — RT_FLOW session lifecycle, RT_UTM Enhanced Web Filtering, RT_IDP intrusion detection alerts, and RT_IDS screen-based DoS protection with JunOS structured syslog.

View on GitHub

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/network-juniper-srx/generator.yml \
  --id srx \
  --live-mode true

Event Types

Event ID	Description	Frequency	Category
SESSION_CLOSE	RT_FLOW session teardown	~45%	network
SESSION_CREATE	Permitted session establishment	~31%	network
WEBFILTER_PERMITTED	URL allowed by EWF category	~13%	network
WEBFILTER_BLOCKED	URL blocked by EWF	~4.5%	network
SESSION_DENY	Session denied by security policy	~4%	network
IDP_ATTACK	IDP signature match	~1.5%	intrusion_detection
RT_SCREEN	Screen alerts (SYN flood, port scan)	~1%	intrusion_detection

Realism Features

Correlated sessions — SESSION_CREATE pushes to shared pool; SESSION_CLOSE pops with matching 5-tuple
Juniper predefined service names — junos-https, junos-dns-udp, junos-ssh, etc.
27 real Enhanced Web Filtering categories (Enhanced_Social_Web_Youtube, Enhanced_Malicious_Web_Sites)
NAT tracking — outbound sessions carry source NAT IP/port through session lifecycle
15 IDP signatures with Juniper-style attack names and severity levels
11 screen event types (SYN flood, TCP port scan, IP spoofing, ICMP flood)

Sample Output

{
  "@timestamp": "2026-02-21T14:32:10.123456+00:00",
  "event": {
    "action": "flow_close",
    "category": [
      "network"
    ],
    "dataset": "juniper_srx.log",
    "outcome": "success",
    "type": [
      "end",
      "allowed",
      "connection"
    ]
  },
  "source": {
    "ip": "10.1.1.30",
    "port": 52341
  },
  "destination": {
    "ip": "142.250.80.46",
    "port": 443
  },
  "juniper": {
    "srx": {
      "application": "SSL",
      "reason": "TCP FIN",
      "service_name": "junos-https",
      "tag": "RT_FLOW_SESSION_CLOSE"
    }
  },
  "observer": {
    "product": "SRX",
    "type": "firewall",
    "vendor": "Juniper"
  }
}

Parameters

Parameter	Default	Description
hostname	srx-fw-01	SRX hostname
domain	example.com	Domain for FQDN
nat_ip	198.51.100.1	Public NAT IP
wf_profile	corporate-web-filter	Web filtering profile
agent_id	a7d2e4f1-...	Filebeat agent ID
agent_version	8.17.0	Filebeat version

Related Generators

Network

Cisco ASA Firewall

Cisco ASA adaptive security appliance syslog — TCP/UDP/ICMP connection lifecycle, ACL permit/deny decisions, NAT translations, VPN tunnel events, and failover status messages.

Network

Check Point Security Gateway

Check Point Security Gateway SmartLog — 8 software blades including Firewall, IPS, Application Control, URL Filtering, Anti-Bot, Anti-Virus, Threat Emulation, and Identity Awareness.

Network

Network Traffic (Continent-Level Geo)

Network traffic events enriched with continent-level geographic information. Models cross-continent and same-continent flows for both inbound and outbound directions, with realistic allow/deny outcomes based on geographic policy.