1-14
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 1 STM Task Flow Overview
Checklist for Monitoring Phase
5.
Monitor network and security activity.
This task encompasses monitoring your network for attacks or issues and responding to them. How users interact
with MARS depends on their role and your operational guidelines. For users who are expected to use the web
interface to monitor traffic in near real-time, this task requires an in-depth understanding of the data that is
correlated and displayed, as well as when and how to respond to suspicious or anomalous behavior.
MARS provides two interfaces to network and security activity: the Summary tab and the Query/Reports tab.
Each interface provides different views and tools to help you understand what is happening on your network.
The Summary tab focuses on near real-time events, whereas the Query/Reports tab focuses on historical, forensic
analysis as described in Step
4.
The Summary tab organizes priority views of your network activity, displaying
hot spot diagrams, recent events, charts of incidents, and a topology diagram, identifying recent activities.
When you identify an incident that requires further investigation or mitigation, you can investigate the incident
to determine whether it is a false positive or block attack using MARS. If you have choke points operating at layer
2, primarily switches, MARS will identify the appropriate device, provide recommended CLI changes, and allow
you to push these changes to the device. If the choke point is a layer 3 device, MARS recommends CLI changes
that you can copy and paste into an administrative session with the identified choke point.
In this manner, you can monitor your network for suspicious behavior and respond to any detections.
Result
: Users understand the views and tools required to monitor, verify, and mitigate attacks on the network.
For more information, see:
•
Network Summary, page 17-1
•
Incident Investigation and Mitigation, page 19-1
•
False Positive Confirmation, page 19-6
•
Rule and Report Groups, page 21-24
•
Event Groups, page 23-2
•
Case Management, page 18-1
•
The False Positive Page, page 19-8
•
Retrieving Raw Messages, page 24-3
Task
