Introducing CSMARS
A Security Information/Event Manager (SIEM, or commonly called a SIM) is a relatively simple tool. In its most basic sense, these devices collect Simple Network Management Protocol (SNMP) and syslog data from security devices and software, and insert it into a database. These devices then provide you with an easy user interface with which to access that information.
By itself, this is nothing special, but what is done after the data is received is important.
The Cisco Security Monitoring, Analysis, and Response System (CS-MARS) product was built to enhance this somewhat common tool by sessionizing the data and providing it with intelligence and knowledge of the network topology. Sessionization refers to the initial summarization of events from multiple devices, providing the knowledge to intelligently identify data streams, sources, and destinations of interesting traffic.
Additionally, CS-MARS gives you false-positive detection and provides instructions for mitigating attacks based on that topology. The CS-MARS appliance can help organizations meet compliance standards and assist in adhering to governmental regulations.
CS-MARS provides a 50,000-foot view of what is occurring on your network. You can think of CS-MARS as an Airborne Warning and Control System (AWACS) for networks.
This chapter explains the basics of the CS-MARS appliance. By the end of this chapter, you should understand what MARS is, what the typical requirements are, and the types of data it collects. You should also understand the basic operation of the MARS appliance.
This book is not an exhaustive guide on how to install, configure, and otherwise operate the MARS appliance. The goal of this book is to provide guidance for designing your MARS deployment and understanding the day-to-day operations of security forensics, the MARS way. It also provides useful information for expanding the default capabilities of MARS through its custom parsing capabilities.
NOTE If this is your first exposure to the MARS appliance, you can review the comprehensive MARS guides at http://www.cisco.com/go/mars.
NOTE Cisco acquired Protego Networks, Inc., which initially developed the MARS appliance technology, in February 2005.
Continue reading here: Security Device Event Exchange SDEE
Was this article helpful?