Summary:
Cisco Security Monitoring, Analysis, and Response System (MARS) provides security monitoring for network devices and host applications supporting both Cisco and other vendors. Security monitoring with MARS greatly reduces false positives by providing an end-to-end topological view of the network, which helps improve threat identification, mitigation responses, and compliance.
This project is an initial deployment into the ASU network. From this project a larger deployment that encompasses the entire university will be designed for future deployment.
The capability of this appliance is to correlate a number of security logs from the ASU network, servers, and possibly personal computers. The initial deployment for the system is in the UTO Data Center.
Other features and benefits of Cisco Security MARS:
- "Learns" the topology, configuration and behavior of the environment
- Automatically updates knowledge of new Cisco IPS signatures, for up to the minute reporting on the environment
- Promotes awareness of environmental anomalies with network behavior analysis using NetFlow and syslog
- Provides simple access to audit compliance reports
- Makes precise recommendations for threat mitigation, including the ability to visualize the attack path and identify the source of the threat with detailed topological graphs that simplify security response at Layer 2 and Layer 3
- Integrates with the Cisco Security Manager to correlate security events with the configured firewall rules and intrusion prevention system (IPS) signatures that can affect the security event.
