19-26
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 19 Incident Investigation and Mitigation
Layer 2 Path and Mitigation Configuration Example
Figure 19-22
Layer 2 topology graph
Perform Mitigation
Once you identify the compromised host (in this example,
10.1.252.250
connected to
CatSw
), it is
critical to prevent it from attacking other hosts in the same subnet or other parts of the network. The
MARS provides one-click mitigation that lets you isolate the compromised host from the rest of the
network.
To perform mitigation, perform these steps:
Step 1
On the
Incident Details screen
, click the
Mitigate
link that corresponds with the
Session
or
Event Type
you want to mitigate (in this case,
Windows RPC DCOM Overflow
). The
Mitigation Information
screen
appears.
