Reading Charts - Cisco CS-MARS-20-K9 - Security MARS 20 User Manual

Chapter 17 Network Summary
•
Rated by the total number of events reported by each security device.
•
The top IP addresses that appear as session sources, ranked by session count.
•
The top IP addresses that appear as session destinations, ranked by session count.
For all of the charts on this page, you can set different time frames, the size of the chart, view the latest
report, and so on, by clicking on the buttons in the chart's window.

Reading Charts

These are stacked charts. You can tell which severity of incident your network has most experienced for
the day by looking for the dominant shade. In the figure below, low priority green incidents cover less
area than high priority red incidents because they have occurred less often.
Figure 17-20
1
3
5
78-17020-01
Activity: All - Top Reporting Devices
Activity: All - Top Sources
Activity: All - Top Destinations
A Day's Events and Netflow with the Legend Displayed
1
2
Displays values by hour, day, week, month,
quarter (the last 3 months), or year.
Displays a larger version of the chart.
The chart legend
3 4
5
2 Sets chart to represent the sum of all zones or
each individual zone (Global Controller only).
4
Displays the chart legend.
User Guide for Cisco Security MARS Local Controller
Summary Page
17-13