Viewing Netflow Generated Incidents in MARS

[Racquel_Mays]

Hello,

I am able successfully view Cisco MARS netflow messages in the GUI.  However, how can I tell if any of the netflow details that I am seeing real-time have generated an incident?  I have run the report "Activity: All Events and Netflow- Top Destinations Ports (Peak View)", but I can not distinguish the netflow details.  Is there another report that I can run/rule which either exists or could be created that speaks specifically to Netflow Generated Incidents?

[Scott Fringer]

Racquel;

  There is not a specific report that will indicate incidents created specifically on netflow data.  In general, CS-MARS uses netflow data to detect anomalous network behavior through statistical analysis.  Over time, CS-MARS develops a baseline of traffic behavior using the netflow data.  Once the baseline is developed, CS-MARS will compare netflow data against the baseline and alert when an increase in traffic is detected.  This is outlined here:

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/user/guide/combo/cfgOver.html#wp180410

  The CS-MARS 'Sudden Traffic Increase...' incidents are related to netflow-based analysis.

  These details are used in conjunction with other events received by the CS-MARS for more effective correlation and incident generation.

Scott