Cisco CS-MARS-20-K9 - Security MARS 20 User Manual page 252

Cisco Incident Control Server
For example, an inspection rule could be written to match the OPACL event. Your mitigation team can
respond by investigating the OPACL that was pushed to the reporting device, from which they can
determine the five tuple (source address and port, destination address and port and network service).
Using that information, they could push equivalent ACLs to devices not managed by Cisco ICS.
When defining inspection rules or reports, you can access the list of Cisco ICS-specific events by
entering Cisco ICS in the Description / CVE: field and clicking Search on the Management > Event
Management page of the web interface.
There are four predefined system inspection rules for Cisco ICS:
• New Malware Discovered
• New Malware Prevention Deployed
New Malware Prevention Deployment Failed
•
New Malware Traffic Match
•
In addition, there are five predefined reports:
Activity: New Malware Discovered - All Events
•
Activity: New Malware Prevention Deployment Failure - All Events
•
Activity: New Malware Prevention Deployment Success - All Events
•
• Activity: New Malware Traffic Match - All Events
• Activity: New Malware Traffic Match - Top Sources
User Guide for Cisco Security MARS Local Controller
8-16
Chapter 8 Configuring Antivirus Devices
78-17020-01