Cisco CS-MARS-20-K9 - Security MARS 20 User Manual page 44

Strategies for Monitoring, Notification, Mitigation, Remediation, and Audit
Task
Tune MARS processing.
7.
Tuning, which is an ongoing activity for any monitoring application, involves refining the sensitivity and
accuracy of how events are processed. In MARS, you can do any of the following to effect such changes.
• Use drop rules to enable or disable the processing of events by MARS.
Note For releases 4.2.3 and earlier of MARS, you cannot define drop rules for a NetFlow-based event. For these
releases, tuning of NetFlow events must be performed on the reporting device.
Turn on or off event generation at the device.
•
Identify selected incidents as false positives.
•
Tune inspection rules to include or exclude specific networks, hosts, services, reporting devices, or traffic
•
flows.
Tune the inspection of traffic by device type, such as IPS and IDS, refining the rule set they use to generate
•
events.
Add or remove reporting devices to alter the reported event set or to provide supporting data that can be used
•
to improve the self-tuning features of MARS, such as false positives, OS fingerprinting, and vulnerability
assessment.
Describe the expected behavior on your network by describing the assets, services, and vulnerability
•
assessment information. The more details MARS knows about your network, the better it can assess the
incoming events.
Result: The events being processed by the MARS Appliance are restricted or expanded to encompass those that
provide the most value to the STM system.
For more information, see:
Appliance-side Tuning Guidelines, page 1-17
•
Working with Drop Rules, page 21-21
•
False Positive Confirmation, page 19-6
•
Selecting the Devices to Monitor, page 2-2
•
Strategies for Monitoring, Notification, Mitigation, Remediation,
and Audit
STM requires the close coordination of multiple strategies in support of your corporate security policies:
•
•
•
•
User Guide for Cisco Security MARS Local Controller
1-16
Monitoring involves the study of network activities and device status to identify anomalous
activities or behavior.
Notification involves alerting those parties responsible for responding to detected anomalies with
the information necessary to respond.
Mitigation involves responding to suspicious activity to prevent the spread of anomalies across your
network.
Remediation involves responding to successful exploits to clean infected hosts on your network.
Chapter 1 STM Task Flow Overview
78-17020-01