Juniper

​

Overview

• SRX series firewalls: flow, threat, IDP, web filtering, and system logs
• MX/EX/QFX switches and routers: system, change, and authentication events
• Junos Space Security Director: central audit and configuration events

​

Prerequisites

• Junos device(s) reachable from your network.
• Admin access (or super-user) to configure syslog or create a Junos Space API user.

​

Step 1: Configure structured syslog on Junos

1. SSH into the device and enter configuration mode:
   configure
   
2. Add a syslog destination pointing at your Atatus log collector:
   set system syslog host <collector-host> any any
   set system syslog host <collector-host> structured-data
   set system syslog host <collector-host> port 514
   
3. For SRX security logs, also configure security log streaming:
   set security log mode stream
   set security log format sd-syslog
   set security log stream atatus host <collector-host>
   
4. Commit the change:
   commit and-quit
   

​

Step 1b (alternative): Junos Space API user

1. Sign in to Junos Space.
2. Go to Role Based Access Control → User Accounts → Create.
3. Create a user with the Audit Administrator role.
4. Note the Junos Space FQDN, username, and password.

​

Step 2: Connect Juniper in Atatus

1. In Atatus, go to Security → Cloud SIEM → Integrations.
2. Locate the Juniper card and click Connect.
3. Fill in the form:

4. Click Connect.

​

Verification

• The Juniper card shows Configured.
• Events appear in Security → Cloud SIEM → Audit Logs → Events with source juniper.