Add A Csa Agent Manually - Cisco CS-MARS-20-K9 - Security MARS 20 User Manual

Cisco Security Agent 4.x Device

Add a CSA Agent Manually

You can manually add a CSA Agent as a child of the CSA MC. This feature allows you to represent all
of your agents, even if they have not generated any notifications.
To add CSA agents manually, follow these steps:
Click Admin > Security and Monitoring Devices.
Step 1
From the list of devices, select the host running Cisco CSA Management Center, and click Edit.
Step 2
Click the Reporting Applications tab, select Cisco CSA Management Center in the Device Type list,
Step 3
and click Edit.
Click the Add Agent.
Step 4
Do one of the following:
Step 5
•
•
In the Device Name field, enter the hostname on which this CSA agent resides.
Step 6
This value should reflect the DNS entry for this device.
Step 7 In the Reporting IP field, enter the IP address that the agent uses to send logs to the CSA MC.
Define each interface that is configured for this host by specifying the interface name, IP address, and
Step 8
network mask. To add a new interface, click Add Interface.
The interface settings are used for attack path calculation. It is very important that you identify any
dual-homed hosts by defining each interface.
Step 9 Click Submit, and then click Done.
To activate this device, click Activate.
Step 10
User Guide for Cisco Security MARS Local Controller
7-8
Select the existing device, click Edit Existing, and continue with
A page displays with the values pre-populated for hostname, reporting IP address, and at least one
interface.
Click Add New, and continue with
Chapter 7
Step 6.
Configuring Host-Based IDS and IPS Devices
Step 8.
78-17020-01