Greetings!
I interested in receiving feedback on the following information sourced from Gartner and where there is any truth to the direction Cisco is taking on MARS:
FINDINGS
Cisco has begun to quietly inform its customers of a decision to freeze support for most non-
Cisco event sources within its Security Monitoring, Analysis, and Response System (MARS).
New versions of non-Cisco vulnerability assessment and firewall technologies will not be
supported by MARS, but maintenance (e.g., updates for new signatures) for currently supported
versions will continue. Cisco also plans to release MARS support for Windows Server 2007 and
Windows Server 2008. Although Cisco has not formally announced its intention to exit the SIEM
market, the Cisco sales force is encouraging its MARS customers to find an alternative for log
collection and event analysis of non-Cisco event sources.
ANALYSIS
Cisco had widely sold MARS as a SIEM solution that was primarily oriented to network security,
and had built the largest SIEM customer base. The technology provides network security
monitoring and host activity monitoring, but Cisco had not provided integration for third-party
network devices. MARS has supported the major operating system platforms, and it has provided
limited third-party security device and application support. Many customers have been using
MARS for a combination of network and host activity monitoring to satisfy both network security
and compliance use cases.
Cisco's recent decision to freeze support for most non-Cisco event sources means that MARS
will become ineffective as a general SIEM solution as new versions of non-Cisco event sources
are implemented. Gartner believes Cisco will focus its efforts on improving Cisco's native security
management capabilities, long a weak spot across Cisco's product line. MARS customers that
require a fully functional SIEM solution will need to transition to an alternative product, while those
that were only integrating MARS to Cisco devices should actually see improved focus by Cisco
on security management across the Cisco security product line.
WHAT YOU NEED TO KNOW
• Organizations Evaluating SIEM Solutions: Organizations that require host activity
monitoring (i.e., monitoring of system, database, and application logs) or monitoring of
non-Cisco network or security devices should not consider Cisco MARS.
• Current MARS Customers That Require General SIEM Capabilities: Organizations
that are currently using MARS to monitor host activity and non-Cisco security devices
and applications should begin planning for a transition to a fully functional SIEM solution.
• Current MARS Customers That Are Focused on Cisco Event Sources:
Organizations that are currently using MARS primarily for Cisco event sources can
continue to apply MARS to this use case.
RECOMMENDED READING
"Magic Quadrant for Security Information and Event Management"
"Critical Capabilities for Security Information and Event Management Technology"
