Overview

The Juniper integration collects logs from devices running Junos OS, including:

• SRX series firewalls — flow, threat, IDP, web filtering, and system logs
• MX/EX/QFX switches and routers — system, change, and authentication events
• Junos Space Security Director — central audit and configuration events

Logs are streamed via structured syslog to an Atatus log collector, or pulled from Junos Space via REST API.

Prerequisites

• Junos device(s) reachable from your network.
• Admin access (or super-user) to configure syslog or create a Junos Space API user.

Step 1: Configure structured syslog on Junos

1. SSH into the device and enter configuration mode:

   configure

1. Add a syslog destination pointing at your Atatus log collector:

   set system syslog host <collector-host> any any
   set system syslog host <collector-host> structured-data
   set system syslog host <collector-host> port 514

1. For SRX security logs, also configure security log streaming:

   set security log mode stream
   set security log format sd-syslog
   set security log stream atatus host <collector-host>

1. Commit the change:

   commit and-quit

Step 1b (alternative): Junos Space API user

1. Sign in to Junos Space.
2. Go to Role Based Access Control → User Accounts → Create.
3. Create a user with the Audit Administrator role.
4. Note the Junos Space FQDN, username, and password.

Step 2: Connect Juniper in Atatus

1. In Atatus, go to Security → Cloud SIEM → Integrations.
2. Locate the Juniper card and click Connect.
3. Fill in the form:

1. Click Connect.

Note: When using syslog, the Junos device pushes events directly to your Atatus log collector and the form needs only the Source and Enabled fields.

Verification

• The Juniper card shows Configured.
• Events appear in Security → Cloud SIEM → Audit Logs → Events with source juniper.