C H A P T E R
10-1
User Guide for Cisco Security MARS Local Controller
78-17020-01
10
Configuring Generic, Solaris, Linux, and
Windows Application Hosts
Revised: June 19, 2007, 78-17020-01
Application hosts are simply hosts on your network that are running important applications. Many of the
supported reporting devices and mitigation devices cannot be represented in MARS until the base host
on which they are running is defined. Examples of such applications include CheckPoint Firewalls and
all forms of web servers.
MARS provides for the definition of the following host types:
•
Generic.
Identifies no specific operating system, as well as any that are not directly supported.
•
Windows.
Identifies one of the Microsoft operating systems.
•
Solaris.
Identifies any of the Solaris family of operating systems.
•
Linux.
Identifies any of the Linux family of operating systems.
You should strive to define the application host as exactly as possible. This guideline applies to the
vulnerability assessment information as well as the general settings. This detailed information helps
MARS determine whether the host is susceptible to known attacks, such as those that specifically target
on operating system or application/service running on the host.
This chapter contains the following sections:
•
Adding Generic Devices, page 10-1
•
Sun Solaris and Linux Hosts, page 10-2
•
Microsoft Windows Hosts, page 10-4
•
Define Vulnerability Assessment Information, page 10-12
Adding Generic Devices
The MARS can support any syslog or SNMP devices, even if they do not appear on the list of devices
supported by the MARS. You can enter any syslog or SNMP device into the network topology, configure
it to report data to the MARS, and query it using a free-form query. For more information on free form
queries, see
To Run a Free-form Query, page 20-2
.
