2-5
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 2 Reporting and Mitigation Devices Overview
Selecting the Devices to Monitor
Firewall
Interface configurations.
Used to populate
topology view and determine expected routes,
which helps refine correlation of traffic traversing
the firewall.
NAT and PAT mappings.
Used to identify the
point of origin attackers and targets and trace
attacks as they spread.
Firewall policies.
When discovering ASA, PIX,
and FWSM, MARS parses ACLs and conduits
(PIX only). For Check Point firewalls, it collects
the firewall policy from policy table.
MARS using this information only for path
computation and mitigation recommendations. It
is not used by any other components, such as
rules, reports, and sessionization.
Firewall logs.
Accepted and denied sessions logs
are used to identify false positives and determine
if potential attacks were blocked before reaching
their targets.
Audit logs.
Associates users with authentication
sessions and assists in identifying exploited
accounts and administrative sessions.
ARP cache tables.
Used to map IP address to
MAC address.
Device status and resource utilization
information.
Used to identify anomalous
network activities based on memory, CPU, and
interface and port statistics.
Enable the following:
•
SNMP RO community strings
•
Syslog messages
•
Device discovery
VPN
Remote user information.
Provides username to
IP address mapping. VPN client helps determine
the person who logged in and performed specific
actions. Clarifies the true point of origin by
identifying the host, not the VPN concentrator.
Login/logout records.
Helps identifies worms by
tracing outbreaks back to a specific user and
provides network access periods.
Device status information.
Identifies whether
the device is operational, which allows prediction
of possible spread of potential attacks and worms.
•
SNMP RO Community strings
Table 2-2
Device Types and Data Available (continued)
Device Type
Data Available
Recommended Configurations
