Cisco Ids 3.1 Sensors; Configure Sensors Running Ids 3.1 - Cisco CS-MARS-20-K9 - Security MARS 20 User Manual

Configuring Network-based IDS and IPS Devices
Revised: September 7, 2007
Network intrusion detection and intrusion preventions systems are a critical source for identifying active
attacks to MARS.
This chapter explains how to bootstrap and add the following network-based IDS and IPS devices to
MARS:
•
•
•
•
•
•
•
•
•
•

Cisco IDS 3.1 Sensors

Before you add the Cisco IDS 3.1 device, make sure that you have configured the Cisco IDS device for
the MARS to retrieve the device configuration. The device configuration would be used for mapping of
the logs received by MARS.
When configuring the IDS device to send logs to the MARS, you must use the exact name of the MARS
Appliance. To determine the name of the appliance, select Admin > System Setup > Configuration
Information and review the value in the Name field.

Configure Sensors Running IDS 3.1

Step 1 Log in to the Cisco IDS device.
Change to directory that has all the configurations files that need to be edited:
Step 2
78-17020-01
Cisco IDS 3.1 Sensors, page 6-1
Cisco IDS 4.0 and IPS 5.x Sensors, page 6-5
Cisco IPS Modules, page 6-10
ISS Site Protector, page 6-13
ISS RealSecure 6.5 and 7.0, page 6-17
IntruVert IntruShield, page 6-22
Snort 2.0, page 6-28
Symantec ManHunt, page 6-29
NetScreen IDP 2.1, page 6-31
Enterasys Dragon 6.x, page 6-33
C H A P T E R
User Guide for Cisco Security MARS Local Controller
6
6-1