Cisco CS-MARS-20-K9 - Security MARS 20 User Manual page 21

Preface
Introduction
Thank you for purchasing the Cisco Security Monitoring, Analysis, and Response System (MARS)
Local Controller. appliance. This guide will help you get the most value from your MARS Appliance.
The information in this document referring to a "MARS appliance" also applies to MARS use as Local
Note
Controller in a Global Controller architecture.
The MARS Appliance
The Cisco Security Monitoring, Analysis, and Response System Appliance (MARS Appliance)– the
MARS 20, MARS 50, MARS 100, and MARS 200 – is a Security Threat Mitigation (STM) appliance.
It delivers a range of information about your networks' health as seen through the "eyes" and "ears" of
the reporting devices in your networks. It takes in all of the raw events from your reporting devices,
sessionizes them across different devices, fires default rules for incidents, determines false positives, and
delivers consolidated information through diagrams, charts, queries, reports, and rules.
The MARS operates at distinct and separate levels based on how much information is provided about
your networks' devices. At its most basic level, MARS functions as a syslog server. As you add
information about reporting devices, it starts sessionizing, and when fully enabled, it presents a
bird's-eye view of your networks with the ability to quickly drill-down to a specific MAC address.
The MARS Web Interface
The MARS user interface uses a tabbed, hyperlinked, browser-based interface. If you have used the Web,
you have used similar Web pages.
Note When using the MARS user interface, avoid using the Back and Forward arrows in the browser. Using
these arrows can lead to unpredictable behavior.
78-17020-01
User Guide for Cisco Security MARS Local Controller
xxi