Does anyone know if you can install CSA on a image and the push it to multiple hosts without issue? Im concerned that they my be (1) seen as the orignal parent-host or (2) not register with CSA-MC correctly.

Has anyone taken the time to use SEPM and try an integrate it with MARS? So far i am just seeing a lot of useless (ie not MARS-ABLE) events. If you have had good success let me know. Thank you.Mike

Does anyone have any tips on monitoring the IPS devices for being up, healthy, not-in-bypass, and running normally, I had five of them fail after the E3 upgrade (one is still tweaked due what TAC has identified as a corrupt license issue). Although ...

I've currently configured a rule to trigger on the keywords (from ASA's) "security negotiation complete" but I receive too many messages (smtp rule)from Lan-to-Lan sites generating this message.

Any way to tune out 11:00PM 12:00PM bandwidth notice "red events"? These are backups over a few t1 interfaces and "false positives". I dont see a way to make the FP for a hourly time range.