1-18
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 1 STM Task Flow Overview
Device Inventory Worksheet
•
Removing devices from inspection.
This technique involves removing a device from inspection
rules. This technique is specific to the events that trigger a specific type of alarm. The advantage of
this technique is that is does not drop all events that match specific criteria received from a reporting
device. In other words, your focus is on reducing a specific false positive rather than all incidents
that are fired based on the events. In addition, the events are retained so that you can review them
using queries and reports.
When using either of these techniques, remember that when you add or modify a rule, you must click
Activate before the changes take effect.
Device Inventory Worksheet
The device inventory worksheet will help you collect the required information about the devices on your
network. It includes the following information:
•
Device name.
Identifies the well-known name of the device. Typically, this name is the DNS name
of the device. MARS uses this name in the topology graph, reports, and events.
•
Reporting IP address.
Identifies the IP address assigned to the network interface from which
MARS will be receiving events. This address is used by MARS to map back to the device name and
to uniquely identify messages and events originating from the device.
•
Management IP address.
Identifies the IP address assigned to the network interface to which
MARS connects to discover the configuration settings for the device.
•
Username/password.
Identifies the account that has the correct authorization to connect to the
management IP address and read or write information based on the role in the network. For reporting
devices, this account must have privileges sufficient for MARS to read the existing configuration.
For mitigation devices, specifically layer 2 switches, this account can enable MARS to publish
actual CLI changes to the device to block detected attacks.
•
Role in system/segment.
Identifies whether this device is a reporting device or a mitigation device.
It can also identify supporting devices, such as DNS and e-mail servers. In addition, the role should
take into account this device’s expected importance relative to the network segment, specifically
relative to the other devices on the same segment. You can qualify this segment-level role using
terms that fit your overall monitoring strategy, such as primary source, second opinion, attack
identification, false positive assessment, session data, and endpoint/MAC address identification.
Understanding the role that a device can or should play at a network segment level helps prioritize
the required and tunable log settings.
•
Required protocols.
Identifies the protocols that this device uses to operate. The primary focus is
on the management protocols, notification protocols, and protocols used to publish audit events.
•
Log settings/SNMP RO community string.
Identifies the specific settings with respect to event
and log generation that are required for this device to satisfy the role that it will play in the MARS
system. It also identifies the SNMP RO community string for this device.
•
Tunable.
Identifies whether you can perform device-side tuning of the log generation.
•
Notify.
Identifies whether this device can receive notifications from MARS.
•
Notification format.
Identifies the format for any notifications that are sent to this device.
