Delete A Device - Cisco CS-MARS-20-K9 - Security MARS 20 User Manual

Chapter 2 Reporting and Mitigation Devices Overview
Click Admin > System Setup > Security and Monitor Devices.
Step 1
Select the checkbox to the left of the device for which you want to change the version, and click Change
Step 2
Version.
The Change the Device Type Version page appears, displaying the device name, vendor, model, and old
version type information.
Select the new version in the New Device Type Version list.
Step 3
To change the version of the device to the new version, click Submit.
Step 4
If any additional changes are available due to the version change, the Edit page appears.
Step 5 If the Edit page appears, make any desired changes and click Submit.
Once you change the version setting for a device, you must click Activate for MARS to correctly process
Step 6
events received from that device. For more information, see
Devices, page

Delete a Device

When you define a reporting device in MARS, this device is added in two separate pages of the web
interface. It appears where you have defined it, on the Admin > Security and Monitoring Devices page,
as well as under the general device identification page under Management > IP Management. This
duplication of content is based on the different functions that each of these pages serves.
The Security and Monitoring Devices page configures the contact and device type information, whereas
the IP Management page is used by the parser module to correlate known devices versus unknown
devices. Typically when you delete a device from the Security and Monitoring Device page, you still
want to retain the knowledge of that device in MARS so that historical incidents and events and cases
can resolve to a known device; therefore, the device is not deleted from the IP Management page.
Deleting a device does disassociate any historical incidents and events from the IP address. In other
Note
words, once you delete the device, you will not be able to find historical events for that device even if
you re-add the device at a later date.
However, if you need to delete and re-add a device to MARS, you must delete the device from both pages
before you attempt to re-add the device.
In addition, as devices are discovered on your network, they are added to the list of devices in the IP
Management page. If you want to add a reporting device and find that you cannot, review the list of
devices in the IP Management page to ensure that the device has not been auto-populated. If it has, you
must first delete that device, then you can add it as a reporting device on the Security and Monitoring
Devices page.
To delete a device, follow these steps:
Select one of the following pages:
Step 1
•
•
Check the box next to each device you want to delete.
Step 2
78-17020-01
2-27.
Admin > Security and Monitoring Devices
Management > IP Management
Adding Reporting and Mitigation Devices
Activate the Reporting and Mitigation
User Guide for Cisco Security MARS Local Controller
2-19