Cisco CS-MARS-20-K9 - Security MARS 20 User Manual page 57

Chapter 2 Reporting and Mitigation Devices Overview
Table 2-2 Device Types and Data Available (continued)
Device Type Data Available
Host OSes Microsoft Windows Hosts
Events found in the security event log as well
application event and system event log.
Solaris and Linux Hosts
Incoming network session logs, via inted, and
FTP transfer logs, via xferlog. In addition, any
events that are written to the system log by
applications and services running on host.
Generic Hosts (All OSes)
Includes system-level information, such as
privilege escalation and buffer overflow. Helps
determine what attacks make it to the host layer.
If MARS learns of activity at the host level, then
it understands that the attack or exploit has
successfully traversed the network. MARS
correlates this data with the network level data to
discover the whole incident and analyze the
exploit method so the administrator can build a
better defense. In some cases, MARS
recommends actions for mitigating the attack. We
recommend that you maintain these
recommended blocks as long as similar attacks
are expected. Typical blocking techniques, such
as IPS shunning, often fail to identify the best
chokepoint for containment. As part of the
recommended action, MARS does identify the
optimal chokepoint where the recommended
action should be effected.
Web Server Same as hosts (SNARE and Perl script agents)
need this when the hosts cannot send us the logs
via syslog. agent is basically a transport.
Web Proxy Mapping from user to site, translations for the IP
address mapping, tells us the real address of the
host who is likely infected. URLs and also
filtering...regulatory compliance.
Database Login/logout to determine the actual user (query
report tab on the data). Privilege escalation, brute
force crack type stuff, or maybe we want to do
regulatory compliance.
78-17020-01
Selecting the Devices to Monitor
Recommended Configurations
Install and configure SNARE, which pushes
events to MARS in near real time, and scales more
efficiently than pulling events from hosts.
• Enable logging for the xferlog and inetd
applications.
• Enable syslog daemon.
• Identify the MARS Appliance as syslog
target.
User Guide for Cisco Security MARS Local Controller
2-7