Threat Response

[grant.bain]

We are considering adding Cisco Threat Response as an extention to our existing IDS4.1 box. We are just at the consultation stage at the moment and would like to find more about the practical advantages of using Cisco Threat Response.

More specifically, I am looking for an insight on Threat Response with regard to how it would help us monitor the network more effectively on a day-to-day basis and how would it do this. and b)if a [potentially] dangerous network event took place to what extent would the Threat Response respond or help network admin to respond.

[travis-dennis_2]

In a basic high level view CTR will help eliminate false positives by actively investigating the target machine and determining if there was indeed a breach or not and send alarms if there was a breach. It also helps in the capture of forensic data to track who did what, what happened, when etc. Overall it's pretty cool.

Here is a link that should get you up to speed.

http://www.cisco.com/en/US/products/sw/secursw/ps5054/index.html

Hope this helps.

Travis

Please remember to rate all replies.