1-7
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 1 STM Task Flow Overview
Checklist for Provisioning Phase
5.
Configure global data collection settings and schedules in MARS.
After you add the devices, you can enable the rich data collection features of MARS, which include:
•
Dynamic vulnerability scanning.
When MARS detects an attack, it can probe the network to determine the
likely success and severity of the attack. To allow this data collection in response to detected attacks, you
must enable the feature and identify which networks to analyze.
•
NetFlow data collection.
NetFlow data enables MARS to identify anomalies by profiling typical data flows
across your network, allowing MARS to detect day-zero attacks, including worm outbreaks. Statistical
profiling takes between four days and two weeks for a MARS Appliance to complete. When the profiles are
developed, MARS begins detecting anomalous traffic flows and creates incidents in response to them. To
configure NetFlow data collection, you must configure those devices that can generate NetFlow traffic, and
you must configure MARS to listen on a shared community string.
•
Layer 3 topology discovery.
A process-intensive operation that discovers the layer 3 network devices (that
is, those devices operating at the IP layer). This layer 3 data is used to determine the attack path vector and
to populate the Topology graphs. You can define the schedule for updating this information.
•
Layer 2 device discovery.
This feature allows MARS to determine the attack path vector and to identify
attacking hosts and targets by MAC address, which eliminates confusion caused by attacks that spoof IP
addresses. This feature is typically configured when adding a switch and enabling mitigation.
There are also several device types from which MARS periodically pulls data. For such devices, you can define
the intervals at which the event logs are retrieved and processed. These update features are as follows:
•
Distributed Threat Mitigation (DTM) device updates.
The DTM services poll Cisco IPS and Cisco IDS
devices to determine the top firing signatures across the reporting devices. Based on this information, MARS
generates the list of top signatures that are firing on the network so that Cisco IOS Routers running the DTM
feature set can query MARS for the list of signatures they should be running.
•
Windows event logs.
You can set the frequency by which MARS pulls audit trail records from Windows
hosts and servers. This setting is global for all such hosts and has a default value of five minutes.
•
Oracle event logs.
You can set the frequency by which MARS pulls audit trail records from Oracle database
servers. This setting is global for all such servers and has a default value of five minutes.
•
Monitored device update scheduler.
You can set the frequency by which MARS pulls data from specific
reporting devices, such as Qualys QualysGuard, Foundstone Foundscan, and eEye REM. Schedules are set
on a per IP address basis.
After you define the settings, you must activate them by clicking Activate on any page in the web interface.
Result
: The schedules for updating cached data pulled from reporting, mitigation, and supporting devices are
defined and activated in MARS. After these settings are defined, MARS can probe the network or pull updates
from reporting, mitigation, and supporting devices.
For more information, see:
•
Data Enabling Features, page 2-28
•
Windows Event Log Pulling Time Interval, page 10-11
•
Layer 2 Discovery and Mitigation, page 2-29
•
Configure Interval for Pulling Oracle Event Logs, page 11-3
•
Networks for Dynamic Vulnerability Scanning, page 2-29
•
Understanding NetFlow Anomaly Detection, page 2-30
•
Configuring Layer 3 Topology Discovery, page 2-37
•
Technology Preview: Configuring Distributed Threat Mitigation with Intrusion Prevention System in
Cisco Security MARS, page 1
•
Scheduling Topology Updates, page 2-39
Task
