cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
572
Views
4
Helpful
4
Replies

MARS Built-in tools

davidcruise
Level 1
Level 1

i heared that mars has built-in scanning tools (Nessus, NMAP), but how the steps to enable this tools to work on resulting incidents

4 Replies 4

mohsin.khan
Level 3
Level 3

Nessus is built-in, hence functional by default. All you got to do is add the devices, use built-in rules which trigger incidents when matched by particualr events/sessions. You don't need to enable/disable these tools as the most recent upgrade of MARS contains most recent signatures/rules for the scanning tools.

regards,

Mohsin

well , but for any incident how do i know that nessus or nmap has run a scan during this incident & how can i see the output of the scan

When you click an incident, on top it will show you the RULE that was matched by the said event/session. And its not that scan is run on events, its just the rule matching process for each and every session (correleted set of events)..

you mean that the scan happens in the background but no means to see that scan happened for specific host?

the second issue: if i added third party VA tool like Mcafee founstone , is there any mean to knoe the scans happened & its content & result