23-5
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 23 Management Tab Overview
IP Management
Step 3
In the
Type
list select: network, IP range, or variable.
Step 4
For each type enter the appropriate information.
•
Network: name, network IP, network mask
•
IP range: name and range
•
Variable: variable name
Step 5
Click
Submit
.
Add a Host
Within MARS, a host is manually or automatically defined as the result of one of the following options:
•
A reporting device or mitigation device defined under the Admin > Security and Monitoring Devices
tab.
•
A host managed by a reporting device defined under the Admin > Security and Monitoring Devices
tab, such as a host running Cisco Security Agent and discovered by MARS when processing the logs
provided by the CSA Management Console.
•
An asset that you want to identify for the purpose of actively interacting with that host from the
MARS system, such as third-party syslog sever to which you want to forward syslog messages using
alerts.
•
A host that is discovered by the system as part of topology discovery. For example, when processing
the ARP cache table on a Cisco Catalyst Switch.
•
A host involved in a session that, at one time or another, was considered suspicious, such as a
potential target of an attack. In this case, MARS will have performed a Nessus and nmap port sweep
of the host to identify whether it was likely breached.
Because of these various options, you can have a large number of hosts defined on the IP Management
page in the web interface. If you do not have a vulnerability assessment package that is compatible with
MARS, you should consider providing as much information as possible about these hosts. For more
information, see
Define Vulnerability Assessment Information, page 10-12
.
Note
If you are attempting to add a host and you are detecting a conflict with a previously defined host,
see
Delete a Device, page 2-19
for additional troubleshooting information.
To manually add a host, follow these steps:
Step 1
Select
Management >
IP Management
.
The IP Management page appears.
Step 2
Click
Add
.
Step 3
In the Type list select
host
.
