Cisco CS-MARS-20-K9 - Security MARS 20 User Manual page 556

List of System Reports
This report tracks the most frequent logins and other user activity by showing the most active user
names.
Activity: All - Top Users.
•
Activity: All - Top Users
Activity: All Events and Netflow - Top Destination Ports.
•
This report ranks the UDP and TCP destination ports of all events (including Netflow events) seen
by MARS over the past hour. This report is used by pages in the Summary tab.
Activity: All Events and Netflow - Top Destination Ports.
•
Activity: All Events and Netflow - Top Destination Ports
Activity: All Sessions - Top Destination Ports by Bytes.
•
This report ranks all destination ports by bytes transferred.
Activity: All Sessions - Top Destination Ports by Bytes.
•
Activity: All Sessions - Top Destination Ports by Bytes
Activity: All Sessions - Top Destinations by Bytes.
•
This report ranks all destinations by bytes transferred.
Activity: All Sessions - Top Destinations by Bytes.
•
Activity: All Sessions - Top Destinations by Bytes
Activity: Attacks Prevented - Top Reporting Devices.
•
This report ranks security devices by the number of attacks prevented.
Activity: Attacks Prevented - Top Reporting Devices.
•
Activity: Attacks Prevented - Top Reporting Devices
Activity: Attacks Seen - Top Event Types.
•
This report ranks the top attack event types.
Activity: Attacks Seen - Top Event Types.
•
Activity: Attacks Seen - Top Event Types
Activity: Attacks Seen - Top Reporting Devices.
•
This report ranks security devices by the number of attack events logged. The security devices can
be firewalls, NIDS and HIDS.
• Activity: Attacks Seen - Top Reporting Devices.
Activity: Attacks Seen - Top Reporting Devices
Activity: Backdoor - Top Destinations.
•
This report ranks the hosts that respond to backdoor connection attempts.
Activity: Backdoor - Top Destinations.
•
Activity: Backdoor - Top Destinations
Activity: Backdoor - Top Event Types.
•
This report ranks the events that detect some form of backdoor activity. A backdoor may be created
by an attacker on a compromised host. A backdoor event can be either an attempt to connect to a
backdoor or a response from a server running a backdoor.
Activity: Backdoor - Top Event Types.
•
User Guide for Cisco Security MARS Local Controller
D-16
Appendix D System Rules and Reports
78-17020-01