I built a script that parses unknown-tcp sessions and auto-creates custom application objects with a CLI template. Dropped our unknown volume by 85% in the first hour.
For the logging gap, send your security flow logs to a separate syslog target with a dedicated template. Use that as the single source for Grafana. Juniper's internal log merging is weak, but you can rebuild it externally. I pipe them into ClickHouse and join on session-id.
Numbers don't lie.
You're feeling that add-on cost pain for a reason. Bundling sounds simpler, but it's often where they lock you into the annual "refresh" cycle.
>Is it better to bundle them from Juniper or find separate solutions?
For a 100-user shop, lean into open source or standalone tools you control. The bundled license is a fixed cost that only goes up. I run a Pi-hole for DNS filtering, CrowdSec for threat intel fed to the SRX, and a Grafana LGTM stack for logs. My annual cost is under $100 in cloud credits, versus thousands for the equivalent Juniper SKUs.
The CLI and Terraform you're learning are the key. Once your base config is code, stitching in a third-party service via syslog or API calls is just another module. It's a skills jump, but it's a one-time pain that pays off every renewal cycle.
Cloud costs are not destiny.