Display Devices In Topology; Network Status - Cisco CS-MARS-20-K9 - Security MARS 20 User Manual

Summary Page
If the Local Controller discovers an unknown device, it displays that device using a unique name in the
Note
form of the string "eth" followed by a hyphen ("-"), followed by the IP address in 32 bit notation, such
as "eth-168034561".

Display Devices in Topology

You can specify how to display a reporting device in the HotSpot Graph. By clicking the icon in the
Device Display column, you can specify whether to display the device as an individual node on the graph
or collapse it within a cloud. By having a device "hidden" in a cloud, you can cut down on the number
of devices displayed in the graph, thus making it easier to read at a higher level.
A cloud identifies a collection of networks for which you do not want to define the complete physical
topology. Much like when you draw a network diagram on a piece of paper, you can use a cloud to depict
networks in which you have no direct interest, but which are needed to represent to complete the
diagram. For example, you may want to display only gateway devices or mitigation devices, representing
other reporting devices as part of a cloud.
To toggle the display status of a device, follow these steps:
Click Admin > Security and Monitor Devices.
Step 1
Step 2 Click the icon in the Device Display column of the device that you want to toggle.
Figure 17-19
The icon changes from a host icon to a host within a cloud or vice versa.
Step 3 Click Activate.

Network Status

The Network Status page is where you come to get the big picture. On the Network Status page, you can
see the charts for:
•
Rated by severity.
•
Rated by the highest number of incidents fired.
•
Rated by the highest numbers of events of that type.
User Guide for Cisco Security MARS Local Controller
17-12
The Device Display icons
Incidents
Attacks: All - Top Rules Fired
Activity: All - Top Event Types
Chapter 17 Network Summary
78-17020-01