Reports - Cisco CS-MARS-20-K9 - Security MARS 20 User Manual

Chapter 20 Queries and Reports
Note
To view the results of the batch query as it is running, click the radio button next to your query (here it's
Step 6
highlighted in green) and click View Results. This can be done while the query is in progress.
If the email address in your user profile on the MARS is valid, the results of your batch query are emailed
to you when the query has completed. You can also view the results of your batch query by clicking
QUERY / REPORTS > Batch Query > View Results.
When you click View Results while the query is in progress, the results compiled up to that moment are
Note
recomputed. This can make the display take longer to appear than after the results are compiled.

Reports

Using the Reports page, you can build repeatable queries, edit and delete current reports, run reports,
and view reports in either HTML or CSV (comma separated value) formats.
Predefined System Reports are treated as global reports. Global Controller receives report data once its
connected to the Local Controller. Previous report results (prior to managing the Local Controller) will
not be pushed up to Global Controller. Thus viewing of reports will not include the information before
the Local Controller becomes active.
When you view a report, you are viewing the last instance that ran. If you want to view an
up-to-the-minute report, resubmit the report before viewing it.
Report results are purged from the database after a purge interval, as tabulated in
Table 20-1
Cisco Security MARS Model
CS-MARS-20-K9
CS-MARS-50-K9
CS-MARS-100-K9
CS-MARS-100E-K9
CS-MARS-200-K9
CS-MARS-GC-K9
CS-MARS-GCM-K9
78-17020-01
In general, do not use the browser refresh or other browser navigation buttons with the
MARS Appliance GUI.
Maximum Database Retention Limits for Report Results
Maximum Number of Stored Reports
1,000 ranking reports
5,000 event/session reports
1,000 ranking reports
5,000 event/session reports
1,000 ranking reports
5,000 event/session reports
1,000 ranking reports
5,000 event/session reports
1,000 ranking reports
5,000 event/session reports
1,000 ranking reports
5,000 event/session reports
1,000 ranking reports
5,000 event/session reports
1
User Guide for Cisco Security MARS Local Controller
Reports
Table 20-1.
2
Database Purge Interval
3 months
3 months
6 months
6 months
6 months
12 months
12 months
20-23