Intruvert Intrushield; Extracting Intruvert Sensor Information From The Intrushield Manager - Cisco CS-MARS-20-K9 - Security MARS 20 User Manual

IntruVert IntruShield

IntruVert IntruShield
To configure IntruVert IntruShield in MARS, you must perform the following tasks:
1.
2.
3.
4.
The following sections provide details on performing each of these tasks:
•
•
•
•

Extracting Intruvert Sensor Information from the IntruShield Manager

IntruVert sensor information is saved in a database on the IntruShield Manager host. When you
configure the MARS to add Intruvert sensors, you can manually add the mapping of each Intruvert sensor
name or you can extract them as a seed file from the database on the Intruvert Manager.
The instructions apply for Intruvert IntruShield version 1.5. IntruVert supports both MySQL and Oracle.
Note
To create a CSV file for IntruVert IntruShield 1.5, follow these steps:
Log in to the database.
Step 1
Perform the query:
Step 2
use lf; select name, ip_address from iv_sensor where ip_address is not
NULL;
Store the query result into a file, remove the header, trailer, and separator lines, and edit the result to a
Step 3
CSV format.
User Guide for Cisco Security MARS Local Controller
6-22
Generate CSV file that identifies each of the IntruShield senor hosts by logging into the database to
which IntruShield Manager writes and performing and saving a database query.
Configure the IntruShield Manager to send SNMP traps to the MARS Appliance
Define a host that represents the management console (IntruVert Manger) in MARS web interface.
From that host in the MARS web interface, import the IntruShield sensor seed file to identify the
IntruVert sensors running on other hosts.
Extracting Intruvert Sensor Information from the IntruShield Manager, page 6-22
Configure IntruShield Version 1.5 to Send SNMP traps to MARS, page 6-23
Configure IntruShield Version 1.8 to Send SNMP Traps to MARS, page 6-23
Add and Configure an IntruShield Manager and its Sensors in MARS, page 6-25
For example, the query result could be:
+------------+------------+
| name | ip_address |
+------------+------------+
| intruvert | 0A010134
| intruvert1 | 0A010135
+------------+------------+
2 row in set (0.00 sec)
You would then edit the above file to appear as:
intruvert,0A010134
intruvert1,0A010135
Chapter 6 Configuring Network-based IDS and IPS Devices
|
|
78-17020-01