Other Security Subjects

Hi,CS-MARS Version details - 6.0.6 ( 3368 )We have setup ePO4 and CS-MARS correctly as per cisco document but CS-MARS does not see any traps coming from ePo server. SNMPWALK is working fine. I have captured packet from ePO4 using tcpdump but no packe...

Hello.Does anyone know if MARS can filter alerts based on data in the trigger packet of an IPS alert?  We have a customer that is getting between 50 and 150 false positve Union Select SQL Injection alerts each day because they sell Sealy Union Select...

Hi to ALL,I have some problems with correlation Rule: Inactive reporting devices."System Rule: Inactive CS-MARS Reporting DeviceThis rule detects reporting devices that have not reported an event in the last hour. For chatty devices such as firewalls...

Hi,I have currently a CSA v6.0.1.135 MC running with 3 CSA agent testmachines (winxpsp3). On the first day the CSA agent events were registered at the CSA MC. Since the day after the installation, no CSA events are appearing anymore on the MC. I chec...

I think integration between Netflow [collector] and IDS will bring the best tool to detect DoS and DDos. Am I right? Any plans to have such functionality in future versions of IDS?

Hi all, I have confusion with managed subnet, we have 3 untrusted vlans, 9 trusted vlans and 3 separate vlans for vlan mapping. all vlans have different ip subnets, but untrusted vlans don’t have ip subnet, it will another vlan’s ip subnet so which ...

I am trying to setup Websense URL filtering. The configuration is pasted below. IOS version "c1841-advipservicesk9-mz.123-14.T6.bin". However, when I do a "sh ip urlfilter config", I see that the Websense URL Filtering is disabled.-------------------...

Hello people,im facing  problem trying to establish a GRE tunnel over  mpls. The topology goes as follows:(server) ----CE1(6500)-----PE1(6500)----vrf cloud-----CE2(6500)--FW-server needs to establish a gre tunnel with FW.-server receives a default ro...

I am using CSA 6, Clam updates work without error on all but two servers. The clam signatures are out of date, I have tried to force the update from the client as well as the CSA MC. There are never any errors or Windows event log entries. But no upd...

Hello friends,I want to upgrade from 4.1 to 4.7 can anybody link me to proper document.Thanks,

Hi,I have recently started seeing a lot of high category alerts with no destination IP or port information.  Event tyores include the following:TCP HijackMicrosoft Plug and Play OverflowTCP Segment OverwriteDoes anyone know why this type of alert occ...