8-16
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 8 Configuring Antivirus Devices
Cisco Incident Control Server
For example, an inspection rule could be written to match the OPACL event. Your mitigation team can
respond by investigating the OPACL that was pushed to the reporting device, from which they can
determine the five tuple (source address and port, destination address and port and network service).
Using that information, they could push equivalent ACLs to devices not managed by Cisco ICS.
When defining inspection rules or reports, you can access the list of Cisco ICS-specific events by
entering
Cisco ICS
in the Description / CVE: field and clicking Search on the Management > Event
Management page of the web interface.
There are four predefined system inspection rules for Cisco ICS:
•
New Malware Discovered
•
New Malware Prevention Deployed
•
New Malware Prevention Deployment Failed
•
New Malware Traffic Match
In addition, there are five predefined reports:
•
Activity: New Malware Discovered - All Events
•
Activity: New Malware Prevention Deployment Failure - All Events
•
Activity: New Malware Prevention Deployment Success - All Events
•
Activity: New Malware Traffic Match - All Events
•
Activity: New Malware Traffic Match - Top Sources
