Cisco CS-MARS-20-K9 - Security MARS 20 User Manual page 13

Case Management
18
C H A P T E R
Incident Investigation and Mitigation
19
C H A P T E R
78-17020-01
18-1
Case Management Overview
Case Management Considerations for the Global Controller
Hide and Display the Case Bar
Create a New Case
18-4
Edit and Change the Current Case
Add Data to a Case
18-6
Generate and Email a Case Report
Incidents Overview
19-1
The Incidents Page
19-2
Time ranges for Incidents
Incident Details Page
19-4
To Search for a Session ID or Incident ID
Incident Details Table
False Positive Confirmation
The False Positive Page
To Tune a False Positive
To Tune an Unconfirmed False Positive to False Positive
To Tune an Unconfirmed False Positive to True Positive
To Activate False Positive Drop Rules
Mitigation
19-10
802.1X Mitigation Example
Prerequisites for Mitigation with 802.1X Network Mapping
Procedure for Mitigation with 802.1X Network Mapping
Display Dynamic Device Information
Virtual Private Network Considerations
Layer 2 Path and Mitigation Configuration Example
Prerequisites for Layer 2 Path and Mitigation
Components Used
19-17
Network Diagram
19-18
Procedures for Layer 2 Path and Mitigation
Add the Cisco Catalyst 5000 with SNMP as the Access Type.
Add the Cisco Catalyst 6500 with SNMP as Access Type (Layer 2 only).
Add the Cisco 7500 Router with TELNET as the Access Type
Verify the Connectivity Paths for Layer 3 and Layer 2
Perform Mitigation
18-1
18-3
18-5
18-7
19-1
19-4
19-4
19-5
19-6
19-8
19-9
19-10
19-11
19-15
19-17
19-17
19-17
19-19
19-26
User Guide for Cisco Security MARS Local Controller
18-3
19-9
19-9
19-11
19-11
19-19
19-20
19-21
19-22
Contents
xiii