CS-MARS NEtflow and Rules Associated With it

[niall-wilkins]

Hello All,

Does anyone know which rules in CS-MARS or Which Rule group is associated with Netflow. i.e. which rule or rules will trigger an incident when a Netflow Event is detected?

[mhellman]

FWIW, there's a new MARS group here:

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=MARS&topic=Discussions

I can't say that I know them all, but I think this is the main one:

netflow events get mapped to the "Built/teardown/permitted IP connection" event type, which in turn is part of the "Info/AllSession" event type group. Look for the event type and the event type group in inspection rules to find out where they apply.