Cisco CS-MARS-20-K9 - Security MARS 20, Руководство пользователя

Страница: 229 / 588

7-3
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 7 Configuring Host-Based IDS and IPS Devices
Entercept Entercept 2.5 and 4.0
Step 3
On the General tab, in the name field, enter a name for the notification.
Step 4 Click the Agent Groups tab and select the All Agents radio button.
Step 5
Click the Security Events tab and select the Events by Severity Levels radio button. Select the events
that you want ( High , Medium , Low , and Information ).
Step 6 Click the System Events tab and select the Events by Severity Levels radio button. Select the events
that you want ( Error , Warning , and Information ).
Step 7
Click the Address Book tab and click a destination in the Available Destinations field. Click the Down
arrow to move it into the Selected Destinations field.
Step 8 Click OK and exit the program.
Add and Configure an Entercept Console and its Agents in MARS
Adding an Entercept device has two distinct steps. First, you add configuration information for the for
the Entercept Console host. Second, you add the agents managed by that console.
• Add and Configure an Entercept Console and its Agents in MARS, page 7-3
•
Add Entercept Agents Manually, page 7-4
• Add Entercept Agents Using a Seed File, page 7-4
Add the Entercept Console Host to MARS
Step 1 Click Admin > Security and Monitor Devices > Add .
Step 2
From the Device Type list, select Add SW Security apps on a new host or Add SW security apps on
existing host .
Step 3 Enter the Device Name and IP addresses if adding a new host.
Step 4
Click Apply .
Step 5
Click on Reporting Applications tab.
Step 6
From the Select Application list, select Entercept 2.5 or 4.0
Step 7
Click Add .
Step 8
Enter the Console Name .
Step 9 Check the “ Is Sensor ” check box—which is asking if it is a sensor or not.
Step 10
Enter the sensor’s Agent Name , which is the agent name for the console if it is an agent.