topic Re: MARS IPS 6 in Network Security https://community.cisco.com/t5/network-security/mars-ips-6/m-p/753432#M85844 <HTML><HEAD></HEAD><BODY><P>ok, let say my uppermanagement wants a report that shows the impact of this 'Unknown" on their network. How can I achieve that?</P><P>gp</P></BODY></HTML> Tue, 28 Aug 2007 17:36:31 GMT garyprice 2007-08-28T17:36:31Z MARS IPS 6 https://community.cisco.com/t5/network-security/mars-ips-6/m-p/753430#M85842 <P>IPS 6 is reporting the STORM WORM...MARS says it is an Unkown Device Event Type. I have latest code and sigs on all platforms.</P><P>Does this report from MARS indicate that I have to train and/or make a catagory or something like that on MARS?</P><P>I want MARS to generate a IPS/sig event description just like all of the other sigs on the IPS that are reported to MARS</P> Sun, 10 Mar 2019 10:46:14 GMT https://community.cisco.com/t5/network-security/mars-ips-6/m-p/753430#M85842 garyprice 2019-03-10T10:46:14Z Re: MARS IPS 6 https://community.cisco.com/t5/network-security/mars-ips-6/m-p/753431#M85843 <HTML><HEAD></HEAD><BODY><P>Signature 5894 Storm Worm was released in S298.</P><P></P><P>The latest Mars release, 4.2.8, only supports up to S294. </P><P></P><P></P></BODY></HTML> Tue, 28 Aug 2007 17:29:55 GMT https://community.cisco.com/t5/network-security/mars-ips-6/m-p/753431#M85843 acomiskey 2007-08-28T17:29:55Z Re: MARS IPS 6 https://community.cisco.com/t5/network-security/mars-ips-6/m-p/753432#M85844 <HTML><HEAD></HEAD><BODY><P>ok, let say my uppermanagement wants a report that shows the impact of this 'Unknown" on their network. How can I achieve that?</P><P>gp</P></BODY></HTML> Tue, 28 Aug 2007 17:36:31 GMT https://community.cisco.com/t5/network-security/mars-ips-6/m-p/753432#M85844 garyprice 2007-08-28T17:36:31Z Re: MARS IPS 6 https://community.cisco.com/t5/network-security/mars-ips-6/m-p/753433#M85845 <HTML><HEAD></HEAD><BODY><P>Welcome to MARS;-)</P><P></P><P>MARS is only updated about once every 2-3 months, and this includes signature updates. The latest release (about 2 days ago) understands Cisco IPS signatures up to S294, so it doesn't understand that signature. Why don't you ask management if they can wait until October? LOL.</P><P></P><P>Anyway, about the best you can do currently is to copy the data into another tool, like Excel, and clean it up.</P></BODY></HTML> Tue, 28 Aug 2007 18:05:30 GMT https://community.cisco.com/t5/network-security/mars-ips-6/m-p/753433#M85845 mhellman 2007-08-28T18:05:30Z