Cisco CS-MARS-20-K9 - Security MARS 20 User Manual page 38

Checklist for Monitoring Phase
You must prepare MARS to closely adhere to your corporate security policy before you begin monitoring
Note
traffic flows, as you must be prepared to react to detected attacks.
The following checklist describes the tasks required to understand the decision-making process and the
basic flow required to operate MARS in the most productive manner. Each step might contain several
substeps; the steps and substeps should be performed in order. The checklist contains references to the
specific procedures used to perform each task.
Task
1. Develop monitoring, notification, mitigation, remediation, and audit strategies.
These strategies are concerned less with desired traffic flows and generated events and focus more on what to do
after MARS Appliance processes that data. These strategies are at the heart of how you will use MARS to protect
your network, taking into account the short- and long-term requirements of monitoring and forensic analysis, as
well as how to stop ongoing attacks and clean infected hosts. These strategies encompass not only your expected
interaction with MARS, but the expectations of your reporting devices as well. Essentially, they identify the roles,
tasks, and data requirements that you anticipate so that you can map events, rules, queries, and reports to those
roles that provide the data required by the identified tasks.
As with any security system, we recommend that users be assigned the lowest-level privilege required to perform
their job. Admin-level privileges should be reserved for administrators of the MARS Appliance.
Result: You have identified the users and roles required to effectively respond to detected attacks and device
issues. You have defined clear guidance for responding to notifications and understand the information
requirements of those such notifications and the expected format and delivery methods to be used.
For more information, see:
Strategies for Monitoring, Notification, Mitigation, Remediation, and Audit, page 1-16
•
Case Management, page
•
User Management, page 23-8
•
, page 23-13
•
User Role Worksheet, page 1-20
•
User Guide for Cisco Security MARS Local Controller
1-10
18-1s
Chapter 1 STM Task Flow Overview
78-17020-01