21-4
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 21 Rules
Rules Overview
Note
You cannot define a custom log parser template for a reporting device that is supported out of the box.
In this case, to define log parser for an unsupported event type, you must still define a custom device
type before you can define the log parser.
Step 4
Check to see if a system rule will capture the information that you want, otherwise write your own user
inspection rule. Define user inspection rules that monitor for the event types and correlate those events
into a structure that will help you identify the incident. You can also specify who should be notified and
how if the rule fires.
Types of Rules
Note
A rule cannot be deleted, it can be made active or inactive.
Inspection Rules
An inspection rule states the logic by which the CS-MARS tests whether or not a single network event
or series of events is a noteworthy incident. An event or series of events with attributes that match the
attributes specified in an inspection rule causes the rule to trigger (or “fire”) to create an incident.
Incidents may be attacks, network configuration errors, false positives, or just anomalous network
activity. The over 100 inspection rules that ship with MARS are called System Inspection Rules. The
number and structure of system rules are updated in signature upgrades and with more recent software
releases. Both types of upgrades are performed from the Admin > System Maintenance > Upgrade page.
You can create custom inspection rules by editing or duplicating system inspection rules, by adding your
own from the Inspection Rules page, or by using the Query interface. Customized inspection rules are
called User Inspection Rules and are displayed on the Inspection Rules page.
Inspection rules can be created on both the Global Controller and the Local Controllers.
Global User Inspection Rules
Global Inspection Rules are inspection rules you create on a Global Controller then push to the
Local Controller. From the Local Controller, you can edit only the Source IP Address, Destination IP
Address, and Action fields of a Global Inspection Rule. To change the arguments of the other fields, you
must edit the rule on the Global Controller. When you edit a global inspection rule on the
Local Controller then edit it again on the Global Controller, the Global Controller version overwrites the
Local Controller version. Global Inspection rule names are displayed with the prefix “Global Rule.”
Drop Rules
Drop rules allow false positive tuning on a MARS, and are defined only on the Local Controller Drop
Rules page. They allow you to refine the inspected event stream by specifying events and streams to be
ignored and whether those data should be stored in the database or discarded entirely. Drop rules are
applied to events as they come in from a reporting device, after they have been parsed and before they
have been sessionized. Events that match active drop rules are not used to construct incidents. Because
the Global Controller does not receive events from reporting devices, rather it receives them from
Local Controllers, you cannot define drop rules for the Global Controller.
