Cisco CS-MARS-20-K9 - Security MARS 20, Руководство пользователя

Страница: 276 / 588

10-14
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 10 Configuring Generic, Solaris, Linux, and Windows Application Hosts
Define Vulnerability Assessment Information
Identify Network Services Running on the Host
By identifying the network services that are running on a host, you are specifying the types of network
activities that you expect for this host. This data is helpful in eliminating expected activities that might
otherwise be flagged as suspicious by MARS; for example, if you have administrative servers that run
network discovery applications or perform vulnerability assessment probes at scheduled times.
To identify the network services running on a host, follow these steps:
Step 1
To select the desired host, do one of the following:
• Select Management > IP Management , select the check box next to the desired host, and click
Edit .
•
Select Admin > Security and Monitor Devices , select the check box next to the desired host, and
click Edit .
Step 2 Click Add New Service under Current running services.
Note It may take five minutes or more for this dialog box to load. You can place the cursor over the title bar
of the window that opens. This allows you to see if the window is still loading.
Step 3
Enter as much detail on the service and its applications as you can.
•
You can choose between selecting a service and defining a new service.
• You can also choose between select an application or defining a new application.
Step 4
Click Submit .
Step 5 You can enter more services here by clicking Add New Service , or you can click Submit to continue.
Step 6
Click Submit to complete the addition of the host.