Cisco CS-MARS-20-K9 - Security MARS 20, Руководство пользователя

Страница: 77 / 588

2-27
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 2 Reporting and Mitigation Devices Overview
Adding Reporting and Mitigation Devices
Run a Reporting Device Query
Another method to see the added devices, is to run a query with the display format: Reporting Device
Ranking .
Note You might not see all of the devices that you loaded using the seed file right away because of lag,
network size and traffic. If you do not see a device after waiting, it could be due to input error.
To run a reporting device ranking query, follow these steps:
Step 1 Click the Queries / Reports tab.
Step 2
On the Queries page, in the Query Event Data table, click Event Type in the Display Format column.
Step 3 Select Reporting Device Ranking .
Step 4
Click Apply .
Step 5 Click Submit to run the query.
Activate the Reporting and Mitigation Devices
After you have added reporting devices and mitigation devices to MARS, you must activate those
devices before MARS begins to fully process the data provided by those devices. This processing is
different from those devices discovered on the network, where the logs sent to the appliance are stored,
but your ability to interact with that data is limited to queries and reports. Typically, MARS runs
inspection rules and generates notifications only against the data retrieved from activated devices.
Once a device is known to the MARS Appliance, all data provided by that particular device can be
normalized and sessionized, which enables that device’s data to be used to fire an incident
Note Default installations of MARS do not fire incidents based on data received from unknown devices.
However, you can still enable this by creating one or more rules that use keyword search. A device must
be defined for the MARS to be able to parse and sessionize the event data. The act of parsing the event
data correctly is what ensures rules fire more accurately.
Tip You must click Activate whenever you add or modify rules, drop rules, reports, or add or modify any
options or settings under in the Admin tab other than those on the User Management subtab. Otherwise,
the changes that you make will not take effect.
To activate added devices, follow these steps:
Step 1 For each device that you want to add, provide the device details and click Submit to add the device.
The Submit action stores the device details in the database. Once you click Submit, your work is saved,
even if you drop the administrative connection before clicking Activate.
Step 2 Once you have all of the devices desired for this administrative session, click Activate .