1-9
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 1 STM Task Flow Overview
Checklist for Monitoring Phase
Checklist for Monitoring Phase
After you complete the provisioning phase, you must configure MARS to help you realize your broader
security goals and requirements. During the monitoring phase, your primary goal is to effectively realize
your monitoring, mitigation, and remediation policies. This phase involves defining the strategies, rules,
reports, and other settings required to achieve this goal.
7.
Monitor and tune event generation and processing.
As with all monitoring applications, tuning log generation and event processing is key to technical accuracy and
performance. You can use two methods to tune which events are processed by MARS:
•
Device-side tuning.
This method involves restricting event generation at the device level. MARS never
receives events that are not relevant to security or device status. It also involves eliminating superfluous,
duplicate data reported by multiple devices on the network, as well as eliminating those events that can be
reproduced by reports or queries in MARS, such as traffic summary syslogs.
•
Appliance-side tuning.
This method involves identifying events received by the MARS Appliance that
represent normal or planned network activity. Drop rules are defined to prevent MARS from processing such
events as part of potential security incidents. When defining such drop rules, you should be as precise in the
definition as possible, for example, identify the source of expected ping sweeps by an IP address within an
expected time period, which is much more difficult to spoof as it requires explicit knowledge of your network
and administrative practices. You can further qualify the rules using a combination of seven conditions:
source, destination, service type, event type, time range, reporting device, and event severity. You must
choose whether to drop the event entirely or to drop it and log it to the database, where it can be used by
queries and reports.
Note
Drop rules do not prevent MARS from storing the event data; they simply prevent the appliance from
processing the events. Events affected by drop rules can still appear a query as they are being stored on the
appliance.You are still storing them; just not processing them for inspection rules.Therefore, if appliance
storage considerations are an issue, we recommend using device-side tuning.
Note
For releases 4.2.3 and earlier of MARS, you cannot define drop rules for a NetFlow-based event. For these
releases, tuning of NetFlow events must be performed on the reporting device.
Tuning is an ongoing task to improve the identification of attacks, report quality surrounding truly suspicious
activities, and the overall performance and accuracy of your STM solution. It involves a detailed study of traffic,
which can be conducted and refined by evaluating the events that are coming into the appliance on a
device-by-device basis.
Tip
In a lab network environment, use a MARS Appliance to study generated events and tuning options on an
individual device type basis. By documenting your requirements in a controlled environment, you can
eliminate much of the production network tuning by establishing valuable device-side tuning standards for
each monitoring device type.
Result
: The events being processed by the MARS Appliance are restricted to those that provide value to the STM
system.
For more information, see:
•
Appliance-side Tuning Guidelines, page 1-17
•
Configuring Logging Policies on Firewall Devices
in
User Guide for Cisco Security Manager 3.0
Task
