IPS Manager Express (IME)

[mathias.mahnke]

Hello Everybody,

I've found recently a new product data sheet -- called Cisco IPS Manager Express, looks a bit like a new implementation of the IPS Event Viewer.

Currently the software download shows an error but everything else is present.

Short url is cisco.com/go/ime

Is anybody aware of this tool? How to download?

Regards

Mathias

[mhellman]

Don't know anything about it, but nice find. It looks promising.

[marcabal · Accepted solution]

IME is the next generation of IEV.

It will do monitoring of IPS events, and will also do configuration of IPS version 6.1 sensors.

IME is targeted at deployments of 5 or less sensors.

IME was announced earlier this week.

It is in final stages of testing and will be available in the next month or 2.

IME will be available for download from cisco.com at no additional charge for customers with active Cisco Service for IPS contracts on their sensors.

In addition IPS version 6.1 was also announced, as well as the AIP-SSM-40 for the ASA firewall.

IPS version 6.1 is primarily changes to work with the new IME.

The AIP-SSM-40 is a higher performing version of the AIP-SSM-10 and AIP-SSM-20, and is targeted for use inside the ASA 5520 and ASA 5540.

[DSmirnov]

You can find IME on RSA Conference this week.

Looks like a much better tool compare with EventViewer (performance stats, dashboards, better quieries). Really interested to see if Cisco will sell the license to manage additional sensors using IME (more then 5).

[mathias.mahnke]

Hello marcabal,

thanks for your detailed feedback!

Regards

Mathias

PS: Next month sounds good, hopefully not so far...

[john.dowson]

Hi Marcoa,

Are there any plans for a version that supports more than 5 devices?

Thanks,

John

[chickman]

That would be CSM

[john.dowson]

CSM seems to be more of a configuration tool. I'm specifically interested in the monitoring capabilities of IME. Looks like a good alternative to MARS.

[chickman]

Well, that is the battle honestly. MARS gives you the event collection and correlation, but no real time reporting. I'm unsure if you're familiar with Security Monitor offered in Ciscoworks VMS, but it is a great tool for this. I mentioned in another post that IME looks to have resurrected this. The reason I say this is because with Security Monitor you could have a window for real time monitoring of alerts that fire on your devices as well as do reporting on those alerts.

To me, I believe IME is going to be the starting point for an all-in-one product for a real time event viewer and report generation.

[Rudy.villalona]

That is correct. MARS will be an Enterprise wide deployable solution that will act as a broader security umbrella for reporting and responding to security alerts. IME will continue to have a limited scope of IPS/IDS hosts that it can recieve events from. IME although limited in various fronts will definately meet the needs of small/medium businesses who are looking to gain quick user friendly access to security events. IME is an incredible step up from IEV...Thanks Cisco!