Cisco CS-MARS-20-K9 - Security MARS 20 User Manual page 337

Chapter 16 Policy Table Lookup on Cisco Security Manager
Figure 16-2
Step 3 Click Incident ID of the incident to examine. The Incident Page appears as shown in
Figure 16-3
Click the Security Manager Policy Query icon in the Reporting Device field to invoke the
Step 4
Security Manager policy table lookup. One of the following three pop-up windows may appear:
–
–
–
In this procedure, the Multiple Events window appears, as shown in
78-17020-01
Procedure for Invoking Cisco Security Manager Policy Table Lookup from Cisco Security MARS
Recent Incidents on MARS Summary Page
MARS Incident Page Displaying the Cisco Security Manager Icon in the
Reporting Device Field
Multiple Events window— Lists all Security Manager device events in the session, this window
appears in this step when there are two or more events in the session.
Multiple Devices window—Lists all matching Security Manager devices that meet criteria
available to MARS, this window appears in this step when there are two or more matching
devices.
Policy Table window—Lists the policy table of the reporting device. Access rules that match
the MARS criteria are highlighted, this window appears in this step when there is one event and
a unique Security Manager device identified.
Figure
User Guide for Cisco Security MARS Local Controller
Figure 16-3.
16-4.
16-15