MARS tutorials and references

[RITgrad2008]

Hello all,

I was wondering if anyone had any good MARS tutorials or reference materials? I can't seem to make this thing do anything useful, partly due to rather limited access to the program, but mainly due to my lack of knowledge of what it can potentially do.

I am familiar with VMS, and I really like the view of all the events in the grid where you can go by each event and analyze them. Is there anything like this in MARS? This sort of functionality would make it a lot easier to transition to MARS.

I know there is a manual for it, however, I either cannot locate it on Cisco's website or it isn't available to my current account level. My coworkers have access to it, but can't seem to remember to send it to me.

Thanks in advance, and I apologize for the nooby question!

- Ryan

[mhellman]

I recommend the following (the group is great too):

http://cs-mars-ug.googlegroups.com/web/new_deployment_guide.pdf?gda=GzNoCEkAAACYiv1J7rmHYohpE8s8NfKQIN_1SGJ0gXR8bACtmgywgGG1qiJ7UbTIup-M2XPURDRwZe8cC3Ln56l1ArCqNd5D5eoPLVJrlkhIOgWgvempMg&hl=en-GB

[pmccubbin · Accepted solution]

Here is mine. Kudos to mhellman for mentioning the Google group!

Bibliography and Websites

1. Security Threat Mitigation and Response by Dale Tesch. Published by Cisco Press, 2006.

2. http://ciscomars.blogspot.com/

3. http://cs-mars.blogspot.com

http://www.demolabs.co.uk

5. Cisco MARS User Group. You must be signed in and a member of this group to view its content:

http://groups.google.com/group/cs-mars-ug?hl=en-GB

6. http://blog.priveonlabs.com/sec_blog.php?cat=14

7. Security Monitoring with Cisco Security MARS by Gary Haleen. Published by Cisco Press, 2007.

Hope this helps.

[RITgrad2008]

Excellent list of resources. I will try to dive into them more over then next week or 2!

Thanks