Table of Contents
Advertisement
Chapter 19
Incident Investigation and Mitigation
Figure 19-11
Click Yes to confirm.
Step 8
Display Dynamic Device Information
To display current, session, and all historical information for an IP address on an 802.1X connection,
follow these steps:
Step 1
Click on the Incident ID to display the session summaries as shown in
Click on the Source IP/Port or Destination IP link of a session.
Step 2
When examining an attacking host, the Source IP address is more relevant.
Step 3
The current connection information pop-up window appears to display any static connection
information.
Step 4
Click Dynamic Info to display current connection information, as shown in
Dynamic information can be derived from 802.1X configurations, Cisco Security Agents, or from other
security software suites. The current connection information is the most recent network information
available for the selected IP address.
Click Session to display the connections related to the specific session, a shown in
Step 5
78-17020-01
Mitigation Confirmation Dialog
Figure
User Guide for Cisco Security MARS Local Controller
Mitigation
19-8.
Figure
19-11.
Figure
19-13.
19-15
Advertisement
Table of Contents
Troubleshooting
