Hi,I have a question from my boss. He would like to know if there is a way to find out the ip address of a person VPNing into our network. Let's say Joe Smith is VPNed in from home and his carrier is cox communications. How would I go about finding o...
Hi,I would like to set my MARS device back to the factory defaults so I can clear out all of my drop rules and start again from scratch. Is there an easy way to do this? Also, what would I need to backup before resetting the device? I would like to j...
Hi,My boss would like me to be able to run a report that includes red (high) incidents only. I've looked through all of the possible reports and can't find anything remotely close to his request. Any help would be appreciated.Thanks,Kerry
Hi,I've recently noticed that ALL the syslog messages that are sent to our Cisco MARS device are then being sent to our syslog server. Besides the messages from our MARS device, the syslog server also gets the original syslog messages from our ASA an...
I have a question about the MARS device. I'm viewing quite a few sessions that are not included in an incident that I know of. Is there any way to find out if a session is included in an incident? Thank you
I do have syslog running, but it would be impossible to try and look thru all of the logs to find something that looked like an outside ip address. But thank you for your response.
Hi Sid,Thanks for the response. Should I be worried about the license? Should I back it up somewhere before I reset the device or is it something I just type in afterward?Thanks,Kerry
Hi Scott,I created a rule so the events and sessions would now be put into an incident, but nothing is showing up. When I view the rule, it is not showing up as active, like the rest of the rules that came with the system. How do I make it active?Tha...
Hi Scott,Thanks for the reply. So if there is no incident ID already associated with a session, is there a way to do this? I have a server that keeps getting hammered by random ip's and I would like this to come up as an incident in MARS, if that is ...
