17-12
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 17 Network Summary
Summary Page
Note
If the Local Controller discovers an unknown device, it displays that device using a unique name in the
form of the string “eth” followed by a hyphen (“-”), followed by the IP address in 32 bit notation, such
as “eth-168034561”.
Display Devices in Topology
You can specify how to display a reporting device in the HotSpot Graph. By clicking the icon in the
Device Display column, you can specify whether to display the device as an individual node on the graph
or collapse it within a cloud. By having a device “hidden” in a cloud, you can cut down on the number
of devices displayed in the graph, thus making it easier to read at a higher level.
A cloud identifies a collection of networks for which you do not want to define the complete physical
topology. Much like when you draw a network diagram on a piece of paper, you can use a cloud to depict
networks in which you have no direct interest, but which are needed to represent to complete the
diagram. For example, you may want to display only gateway devices or mitigation devices, representing
other reporting devices as part of a cloud.
To toggle the display status of a device, follow these steps:
Step 1
Click
Admin > Security and Monitor Devices
.
Step 2
Click the icon in the Device Display column of the device that you want to toggle.
Figure 17-19
The Device Display icons
The icon changes from a host icon to a host within a cloud or vice versa.
Step 3
Click
Activate
.
Network Status
The Network Status page is where you come to get the big picture. On the Network Status page, you can
see the charts for:
•
Incidents
Rated by severity.
•
Attacks: All - Top Rules Fired
Rated by the highest number of incidents fired.
•
Activity: All - Top Event Types
Rated by the highest numbers of events of that type.
