Table Of Contents - Cisco CS-MARS-20-K9 - Security MARS 20 User Manual

Contents
Selecting the Access Type
Bootstrap Summary Table
Adding Reporting and Mitigation Devices
Data Enabling Features
User Guide for Cisco Security MARS Local Controller
iv
Reporting IP
2-9
Interface Settings
2-10
2-10
Configure SNMP Access for Devices in MARS
Configure Telnet Access for Devices in MARS
Configure SSH Access for Devices in MARS
Configure FTP Access for Devices in MARS
2-12
Add Reporting and Mitigation Devices Individually
Edit a Device
2-18
Upgrade the Device Type to a Newer Version
Delete a Device
2-19
Delete All Displayed Reporting Devices
Add Multiple Reporting and Mitigation Devices Using a Seed File
Devices that Require Custom Seed Files
Devices that Require Updates After the Seed File Import
Seed File Header Columns
Load Devices From the Seed File
Adding Reporting and Mitigation Devices Using Automatic Topology Discovery
Verify Connectivity with the Reporting and Mitigation Devices
Discover and Testing Connectivity Options
Run a Reporting Device Query
Activate the Reporting and Mitigation Devices
2-28
Layer 2 Discovery and Mitigation
Networks for Dynamic Vulnerability Scanning
Select a Network for Scanning
Create a Network IP Address for Scanning
Create a Network IP Range for Scanning
Understanding NetFlow Anomaly Detection
How MARS Uses NetFlow Data
Guidelines for Configuring NetFlow on Your Network
Enable Cisco IOS Routers and Switches to Send NetFlow to MARS
Configuring Cisco CatIOS Switch
Enable NetFlow Processing in MARS
Host and Device Identification and Detail Strategies
Configuring Layer 3 Topology Discovery
Add a Community String for a Network
2-11
2-11
2-12
2-12
2-16
2-17
2-18
2-20
2-21
2-21
2-24
2-26
2-27
2-27
2-29
2-29
2-30
2-30
2-30
2-30
2-31
2-32
2-34
2-34
2-36
2-37
2-37
2-20
2-21
2-25
2-26
2-32
78-17020-01