Most engineers think…
Most people picture SRX threat prevention as 'signature-based antivirus that catches known malware'. That picture fails in an interview and gets you killed in production by zero-days.
Juniper ATP Cloud is a cloud-delivered analysis brain: the SRX extracts suspicious files and sends them to a multi-stage cloud sandbox that uses deception, multiple AV engines and machine learning to score the file 0–10. Simultaneously, SecIntel feeds — C2 server IPs, infected-host IPs, malicious domains and URLs — are pushed to the SRX data plane and enforced at line rate, so known-bad traffic is blocked without ever hitting the cloud. Understanding that split — cloud analysis for unknowns, on-box feeds for knowns — is what lets you design, size and troubleshoot ATP deployments correctly.
① What Juniper ATP Cloud actually is — cloud brain, on-box feeds
The single most important idea: ATP Cloud (formerly Sky ATP) is not antivirus on the SRX. The SRX is the enforcement point; the intelligence lives in the cloud. When the SRX intercepts a file matching the configured policy, it sends a copy to the ATP Cloud service, which analyses it and returns a verdict score of 0–10. The SRX then takes the configured action — permit, drop, or quarantine — based on that score.
The second pillar is SecIntel. Rather than waiting for a cloud round-trip on every packet, the ATP Cloud service continuously pushes curated threat feeds to the SRX. The SRX data plane holds these feeds in memory and blocks matching traffic at line rate — no latency, no dependency on cloud reachability at the moment a packet arrives. The two pillars are complementary: cloud analysis catches unknown threats; on-box feeds stop known-bad infrastructure instantly.
Which statement best describes Juniper ATP Cloud on the SRX?
② The malware analysis pipeline — sandbox, ML and the 0–10 verdict
When the SRX sends a file to ATP Cloud, it passes through a multi-stage pipeline. First, the file is triaged by multiple antivirus engines running in parallel. Files that survive initial screening enter the cloud sandbox, a controlled execution environment that uses deception techniques — simulated mouse movement, realistic keystrokes, installed common software — to trick evasive malware into revealing its true behaviour. Results from both stages feed a machine-learning model that produces the final 0–10 verdict, balancing all signals to reduce false positives.
Acting on the verdict
The verdict is returned to the SRX along with a file cache entry so the same hash is never sent twice. You configure threat policy thresholds: for example, verdict 8–10 = drop, 5–7 = quarantine and notify, 0–4 = permit. Files in flight while analysis runs can be held in a hold buffer or permitted and retrospectively actioned when the verdict arrives — a trade-off between security and latency you tune per profile.
A deception-based cloud execution environment that tricks evasive malware with simulated mouse movements, keystrokes and installed software, then feeds results to the ML verdict engine.
The combined output of multi-AV triage, sandbox analysis and ML scoring. 0 = clean, 10 = highly malicious. You configure per-profile thresholds to set the SRX action.
A continuously updated list of known command-and-control server IPs pushed to the SRX data plane. Matching outbound sessions are dropped at line rate — no cloud lookup needed.
IPs of devices that have already called home to a C2 server, published by ATP Cloud and pushed to every SRX in the estate. Enabled across all ATP license tiers for automatic quarantine.
ATP Cloud stores the verdict against a file hash. The second time the same file appears anywhere in your estate — any branch, any SRX — the SRX matches the cached verdict locally and acts immediately without sending the file to the cloud again. This collapses latency for repeat encounters and is why ATP Cloud scales across large estates without proportional cloud traffic growth.
What is the highest possible ATP Cloud file verdict score, indicating maximum malicious confidence?
③ SecIntel feeds — C2, infected-host, domain and URL at line rate
SecIntel is the on-box intelligence layer. ATP Cloud (and Juniper Threat Labs plus curated third-party sources) publishes four feed types that the SRX downloads and enforces at line rate without cloud round-trips.
- C&C (Command & Control) feed — IP addresses of known C2 servers. When an inside host tries to reach one, the SRX drops the session and raises a security event.
- Infected-host feed — IP addresses of hosts that have already called home to a C2. Enabled for all ATP license tiers; lets you quarantine compromised devices automatically.
- Malicious domain feed — DNS-level blocking of domains associated with malware distribution, phishing and C2 infrastructure.
- Malicious URL feed — HTTP/HTTPS URL matching for known-bad download paths and exploit kits.
Adaptive Threat Profiling (ATP) adds a fifth capability: the SRX acts as a feed aggregator for your own organisation, building custom feeds from observed behaviour and sharing them with all other SRX firewalls in your estate at regular intervals — turning your network into a self-improving threat sensor.
The infected-host feed is enabled for ALL ATP Cloud license tiers, including the base tier. The misconception that SecIntel is a premium-only feature costs teams easy wins. The C2, malicious-domain and malicious-URL feeds require a standard or premium subscription, but infected-host coverage is always on.
▶ Watch a malicious download get caught end-to-end
A user downloads a file that ATP Cloud identifies as malware. Press Play for the healthy detection path, then Break it to see the most common field failure.
An inside host is connecting to a known C2 server. Which SecIntel feed should block this session at line rate?
④ Configuration, tuning and failure diagnosis
ATP Cloud configuration on the SRX has three logical steps. First, create an ATP Cloud profile that points the SRX at your ATP Cloud tenant (realm + token). Second, define threat policies that map verdict score ranges to actions (permit / drop / quarantine). Third, enable SecIntel feed download in the security policy and bind it to the correct zones. Adaptive Threat Profiling is an optional fourth step that turns on the custom-feed aggregation loop.
Common failure modes
The three most common issues are: file not sent — usually a missing application identification (AppID) profile or the file type not matching the extraction policy; verdict never returned — a cloud-reachability or authentication (realm/token) problem; feed stale — the SRX cannot reach srxatp.junipersecurity.net on port 443, often a firewall or proxy blocking the update channel. Check show advanced-anti-malware statistics and show security intelligence feed status to isolate which leg has failed.
Vikram at a Pune fintech firm faces this
The security team notices a workstation is making outbound connections to unusual foreign IPs every 15 minutes. The SRX ATP Cloud is licensed and deployed but generated no alert.
The C2 SecIntel feed is configured but the SRX cannot reach srxatp.junipersecurity.net on port 443 — an upstream firewall rule was blocking the update channel, so the feed is weeks out of date and does not include this new C2 infrastructure.
Run 'show security intelligence feed status' — the C2 feed shows last-updated timestamp over two weeks ago and feed-download failures.
CLI ▸ show security intelligence feed status ▸ show security intelligence statisticsOpen port 443 outbound to srxatp.junipersecurity.net from the SRX management or data plane interface. Force an immediate feed refresh with 'request security intelligence download'. Verify the C2 feed updates to a current timestamp, then confirm the workstation's outbound sessions are now dropped.
After the fix: 'show security intelligence feed status' shows a recent update time; the workstation's outbound sessions appear as drops in the security log with reason C2-feed-match.
Never assume SecIntel feeds are current. Before declaring an ATP investigation complete, run 'show security intelligence feed status' and confirm the last-updated timestamp for each feed type is recent. A stale feed means your line-rate blocking is running on old data — exactly the condition an attacker using new C2 infrastructure can exploit.
The SRX is not sending files to ATP Cloud. Which is the most likely first place to check?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: explain in your own words why Juniper ATP Cloud needs two pillars — cloud analysis AND on-box SecIntel feeds. Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- ATP Cloud (Advanced Threat Prevention Cloud)
- Juniper's cloud-delivered threat analysis service (formerly Sky ATP) that sandboxes files and returns 0–10 verdicts to the SRX, and distributes SecIntel feeds.
- SecIntel
- On-box threat intelligence feeds (C2 IPs, infected-host IPs, malicious domains, malicious URLs) pushed to the SRX data plane and enforced at line rate.
- Verdict score
- A 0–10 risk number returned by ATP Cloud for each analysed file: 0 = clean, 10 = highly malicious. SRX threat policies map score ranges to actions.
- C2 (Command and Control) feed
- A SecIntel feed of known C2 server IP addresses. Outbound connections to these IPs are dropped by the SRX data plane at line rate.
- Infected-host feed
- A SecIntel feed of inside-host IPs that have already called home to a C2. Available on all ATP license tiers; used for automatic quarantine.
- Cloud sandbox
- The ATP Cloud execution environment that runs suspicious files using deception techniques (simulated mouse, keystrokes, installed software) to reveal evasive malware behaviour.
- Adaptive Threat Profiling
- A mode where the SRX reports observed threat indicators to ATP Cloud, which builds custom feeds and redistributes them to all SRX devices in the estate.
- Hold buffer
- An SRX option that holds an in-transit session until the ATP Cloud verdict is returned, preventing file delivery to the endpoint before a malicious verdict is known.
- File cache
- An SRX-side cache of file hashes and their ATP Cloud verdicts, so the same file is never submitted to the cloud twice — repeat encounters are actioned immediately.
📚 Sources
- Juniper Networks — Juniper Advanced Threat Prevention Datasheet. juniper.net/us/en/products/security/srx-series/juniper-advanced-threat-prevention-datasheet.html
- Juniper Networks Documentation — ATP Cloud User Guide: How Malware Is Analysed and Detected. juniper.net/documentation/us/en/software/atp-cloud/atp-cloud-user-guide
- Juniper Networks Documentation — SecIntel Feeds Overview and Benefits. juniper.net/documentation/us/en/software/atp-cloud/atp-cloud-user-guide/topics/concept/secintel-feeds-overview-and-benefits.html
- Juniper Networks Documentation — Adaptive Threat Profiling Overview and Configuration. juniper.net/documentation/us/en/software/atp-cloud/atp-cloud-user-guide/topics/concept/adaptive-threat-profiling-overview-and-deployment.html
- Juniper Networks Documentation — ATP Cloud Administrator Guide (PDF). juniper.net/documentation/us/en/software/atp-cloud/atp-cloud-admin-guide/atp-cloud-admin-guide.pdf
- Security Scientist — 12 Questions and Answers About Juniper ATP Cloud. securityscientist.net/blog/12-questions-and-answers-about-juniper-atp-cloud/
What's next?
Got ATP Cloud covered? Next, go deep on Juniper Policy Enforcer and Security Director — how they distribute SRX policy across the entire network from a single pane.