Cisco CS-MARS-20-K9 - Security MARS 20 User Manual page 103

Chapter 2 Reporting and Mitigation Devices Overview
Cisco Secure ACS
•
Cisco Security Agent
•
To enable NAC reporting on your network, you must ensure that the NAC-specific events are logged by
the reporting devices, that those devices forward the events to MARS, and that the device is defined in
the web interface as a reporting device or mitigation device.
The following reports are available to support NAC:
Activity: AAA Failed Auth - All Events (Total View)
•
Activity: AAA Failed Auth - Top NADs (Total View)
•
Activity: AAA Failed Auth - Top Users (Total View)
•
Activity: Security Posture: Healthy - Top Users (Total View)
•
• Activity: Security Posture: NAC - Top NADs (Total View)
Activity: Security Posture: NAC - Top NADs and Tokens (Total View)
•
Activity: Security Posture: NAC - Top Tokens (Total View)
•
Activity: Security Posture: NAC Agentless - Top Hosts (Total View)
•
Activity: Security Posture: NAC Agentless - Top NADs (Total View)
•
Activity: Security Posture: NAC Agentless - Top Tokens (Total View)
•
Activity: Security Posture: NAC Audit Server Issues - All Events (Total View)
•
Activity: Security Posture: NAC End Host Details - All Events (Total View)
•
• Activity: Security Posture: NAC Infected/Quarantine - All Events (Total View)
Activity: Security Posture: NAC Infected/Quarantine - Top Hosts (Total View)
•
Activity: Security Posture: NAC L2 802.1x - Top Tokens (Total View)
•
Activity: Security Posture: NAC L2IP - Top Tokens (Total View)
•
Activity: Security Posture: NAC Static Auth - Top Hosts (Total View)
•
Activity: Security Posture: NAC Static Auth - Top NADs (Total View)
•
Activity: Security Posture: NAC Static Query Failure - Top Hosts (Total View)
•
Activity: Security Posture: Not Healthy - All Events (Total View)
•
• Activity: Vulnerable Host Found (Total View)
• Activity: Vulnerable Host Found via VA Scanner (Total View)
The following system rules are available to support NAC:
System Rule: Security Posture: Audit Server Issue - Network Wide
•
System Rule: Security Posture: Audit Server Issue - Single Host
•
System Rule: Security Posture: Excessive NAC Status Query Failures - Network Wide
•
System Rule: Security Posture: Excessive NAC Status Query Failures - Single Host
•
System Rule: Security Posture: Excessive NAC Status Query Failures - Single NAD
•
• System Rule: Security Posture: Infected - Network Wide
• System Rule: Security Posture: Infected - Single Host
System Rule: Security Posture: Quarantine - Network Wide
•
System Rule: Security Posture: Quarantine - Single Host
•
78-17020-01
User Guide for Cisco Security MARS Local Controller
Data Enabling Features
2-53