Quick setup collecting network systens for MARS

[hk47jr]

Hi everyone,

anyone knows how to quickly deploy the MARS to gather information systems:

Oracle

Microsoft

Linux

Symantec

Something that is already standard for collecting and fast to deploy and configure in the MARS.

Sincerely

Jose

[Scott Fringer · Accepted solution]

Jose;

  It would be best to review the configuration guide for each of the device types you mentioned:

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/device/configuration/guide/GbkDcgMars.html

  Most devices will require configuration on both the CS-MARS (to configure as a reporting device) and on the monitored device itself. If you have questions regarding a specific device, let us know.

Scott

[hk47jr]

Hi Scott,

thanks for your answer.

I've been analyzing this document, and I think he is too slow to be implemented, and I wonder if anyone have any other faster.

Another issue is that the logs of the reported devices are standard for MARS or I'll have to configure them manually, I find no reference about this case.

Anyway thaks.

Jose

[Scott Fringer · Accepted solution]

Jose;

  There is not anything faster as configuring CS-MARS is an involved process.

  Here is a link to the latest devices that CS-MARS can support natively:

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.1/compatibility/local_controller/dtlc6x.html

  Any device or version not listed in the above link will require a custom device type and supporting parsers be created.

Scott

[hk47jr]

Ok Scott, thanks for your help.