Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
It appears the S387 signature set contains quite a few new signatures. Many of the signatures are disabled by default, and the ones that I checked are for older vulnerabilities.Is this simply a back-fill of older vulnerabilities using the newer engin...
Does anybody know how to collect either the "Error Events" or the "Status Events" from 4200 series IPS devices in CS-MARS? The only events that seem to be collected by CS-MARS are the "Alert Events".
I am running MARS 6 software. While I am getting a lot of operational value, I still have a lot of setup questions.Today it is if MARS tracks the DHCP assignments. We use Active Directory for our dynamic devices, and of course DHCP to get addresses a...
We have a number of devices that are quite "quiet" under normal conditions in our network -- rarely reporting activity to the CS-MARS device. This is normal for these devices.I see this in both Cisco IPS v6 sensors and Cisco IOS switches with SNMP RO...
I realize the signature sets are cumulative. It seemed the S387 set had a much larger than usual number of "new" signatures, some for of the new signatures for vulnerabilities that have been around for a while.I am interested in why the large number ...
Download and upgrade from 5.3.6 was easy and pain free. (Note - your experience may very, my upgrade was for a small 110R system that has only had 5.3 loaded, and "only" 72 devices being monitored.)