| Description |
1 online resource |
| Series |
Cisco Press networking technology series |
|
Cisco Press networking technology series.
|
| Bibliography |
Includes bibliographical references and index. |
| Contents |
Ch. 1. Introducing CS-MARS -- Ch. 2. Regulatory challenges in depth -- Ch. 3. CS-MARS deployment scenarios -- Ch. 4. Securing CS-MARS -- Ch. 5. Rules, reports, and queries -- Ch. 6. Incident investigation and forensics -- Ch. 7. Archiving and disaster recovery -- Ch. 8. Integration with cisco security manager -- Ch. 9. Troubleshooting CS-MARS -- Ch. 10. Network admission control -- Ch. 11. CS-MARS custom parser -- Ch. 12. CS-MARS global controller -- App. A. Querying the archive -- App. B. CS-MARS command reference. |
| Summary |
Security Monitoring with Cisco Security MARS Threat mitigation system deployment Gary Halleen Greg Kellogg Networks and hosts are probed hundreds or thousands of times a day in an attempt to discover vulnerabilities. An even greater number of automated attacks from worms and viruses stress the same devices. The sheer volume of log messages or events generated by these attacks and probes, combined with the complexity of an analyst needing to use multiple monitoring tools, often makes it impossible to adequately investigate what is happening. Cisco® Security Monitoring, Analysis, and Response System (MARS) is a next-generation Security Threat Mitigation system (STM). Cisco Security MARS receives raw network and security data and performs correlation and investigation of host and network information to provide you with actionable intelligence. This easy-to-use family of threat mitigation appliances enables you to centralize, detect, mitigate, and report on priority threats by leveraging the network and security devices already deployed in a network, even if the devices are from multiple vendors. Security Monitoring with Cisco Security MARS helps you plan a MARS deployment and learn the installation and administration tasks you can expect to face. Additionally, this book teaches you how to use the advanced features of the product, such as the custom parser, Network Admission Control (NAC), and global controller operations. Through the use of real-world deployment examples, this book leads you through all the steps necessary for proper design and sizing, installation and troubleshooting, forensic analysis of security events, report creation and archiving, and integration of the appliance with Cisco and third-party vulnerability assessment tools. "In many modern enterprise networks, Security Information Management tools are crucial in helping to manage, analyze, and correlate a mountain of event data. Greg Kellogg and Gary Halleen have distilled an immense amount of extremely valuable knowledge in these pages. By relying on the wisdom of Kellogg and Halleen embedded in this book, you will vastly improve your MARS deployment."--Ed Skoudis, Vice President of Security Strategy, Predictive Systems Gary Halleen is a security consulting systems engineer with Cisco. He has in-depth knowledge of security systems as well as remote-access and routing/switching technology. Gary is a CISSP and ISSAP. His diligence was responsible for the first successful comput ... |
| Subject |
Computer networks -- Security measures.
|
|
Computer security -- Evaluation.
|
|
Réseaux d'ordinateurs -- Sécurité -- Mesures. |
|
Sécurité informatique -- Évaluation. |
|
Computer networks -- Security measures. |
|
Computer security -- Evaluation. |
|
Computer networks -- Security measures |
|
Computer security -- Evaluation |
| Added Author |
Kellogg, Greg.
|
| Other Form: |
Print version: Halleen, Gary. Security monitoring with Cisco security MARS. Indianapolis, Ind. : Cisco Press, 2007 (DLC) 2007021272 |
| ISBN |
9781587052705 (paperback) |
|
1587052709 (paperback) |
|
More Resources