Cisco CS-MARS-20-K9 - Security MARS 20, Руководство пользователя

Страница: 216 / 588

6-26
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 6 Configuring Network-based IDS and IPS Devices
IntruVert IntruShield
Add the IntruShield Manager Host to MARS
To define the host and represent the management console for IntruShield, follow these steps:
Step 1 Click Admin > System Setup > Security and Monitor Devices > Add .
Step 2
From the Device Type list, select Add SW Security apps on a new host or Add SW security apps on
existing host .
Step 3 Enter the Device Name and IP addresses if adding a new host.
Step 4
Click Apply .
Step 5
Click Reporting Applications tab.
Step 6
Select IntruVert IntruShield 1.5 from the Select Application list.
Step 7 To complete the definition of this console, click Add .
Figure 6-14 Add IntruShield Sensors
Step 8
Continue defining the sensors that the console manages using one of two methods:
• Add IntruShield Sensors Manually, page 6-26
•
Add IntruShield Sensors Using a Seed File, page 6-27
Add IntruShield Sensors Manually
To add sensors manually, follow these steps:
Step 1
Click Add Sensor .
Step 2 Enter the Device Name , Sensor Name , and its Reporting IP address.
•
Device Name – the DNS entry for this device
• Sensor Name – the name as it appears in the console
•
Reporting IP – the IP address that the agent uses to send logs to the console
Step 3 Add the interface information.
Step 4
For attack path calculation and mitigation, specify the networks being monitored by the sensor. Do one
of the following:
To manually define the networks, select the Define a Network radio button.
a.
Enter the network address in the Network IP field.