D-3
User Guide for Cisco Security MARS Local Controller
78-17020-01
Appendix D System Rules and Reports
List of System Rules
This rule indicates that the current CS-MARS database partition filled up to 75% of its capacity and
the next database partition will be purged soon to create space for new events. The estimated purge
times are in the event message. This is normal CS-MARS activity and will result in old events and
incidents to purged from CS-MARS database. Users are urged to archive CS-MARS data to prevent
permanent data loss.
•
System Rule: CS-MARS Host Mitigation - Failure.
This rule triggers when CS-MARS is unable to successfully mitigate a host after having tried a few
times.
•
System Rule: CS-MARS Host Mitigation - Success.
This rule triggers when CS-MARS is able to successfully mitigate a host.
•
System Rule: Database Privileged Command - Failures.
This correlation rule detects multiple failed attempts from the same database user to execute
privileged database commands.
•
System Rule: DoS: Network - Attempt.
This rule detects network level denial of service (DoS) attacks along with relevant reconnaissance
activity that may have preceded the attacks. Such attacks can create a dramatic increase in overall
network traffic.
•
System Rule: DoS: Network - Success Likely.
This correlation rule detects the simultaneous occurrence of network level denial of service (DoS)
attacks along with related events such as traffic anomaly (e.g. ICMP echo request/reply or TCP
SYN/FIN anomaly), network devices reporting high utilization, excessive scans or denies in the
network etc. This may indicate that the network is under denial of service attack.
•
System Rule: DoS: Network Device - Attempt.
This correlation rule detects attacks on network devices (such as switches, routers, firewalls) along
with relevant reconnaissance activity that may have preceded these attacks. Such attacks if
successful, can crash the network devices and create a denial of service for the network segment
containing these devices.
•
System Rule: DoS: Network Device - Success Likely.
This correlation rule detects attacks on network devices (such as switches, routers, firewalls) along
with (a) local high usage conditions reported by the device and (b) relevant reconnaissance activity
that may have preceded these attacks.
•
System Rule: Inactive CS-MARS Reporting Device.
This rule detects reporting devices that have not reported an event in the last hour. For chatty devices
such as firewalls and IDS, this may indicate connectivity issues or an issue with the device
themselves. This rule should be scoped down to only include chatty network infrastructure devices.
•
System Rule: Local Attack - Attempt.
This correlation rule detects attacks on hosts by logged on users. Such attacks include local buffer
overflow attacks, sym link attacks etc.
•
System Rule: Local Attack - Success Likely.
This correlation rule detects attacks on hosts by locally logged on users followed by the server
performing anomalous activities - such activities include excessive denies and scans, connection to
backdoors, attempts to propagate worms etc. The presence of such activities may indicate that the
host is compromised.
•
System Rule: Misc. Attacks: Access Web Customer Data.
