Filter
Top Products
69-25
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter 69 Using External Monitoring, Troubleshooting, and Diagnostic Tools
Integrating CS-MARS and Security Manager
Step 2 Click the Add button to add a CS-MARS server. The New CS-MARS Device dialog box opens (see New
or Edit CS-MARS Device Dialog Box, page 11-5 for detailed information).
Step 3 In the New CS-MARS Device dialog box, enter the IP address or fully qualified DNS host name of the
server, and a user name and password for logging into the server. If you add a local controller, the user
name you enter can be either a local account or a global account. Choose the type of account from the
User Type list.
Tip If you are using CS-MARS Global Controllers, add them instead of individual Local Controllers.
By adding Global Controllers, Security Manager can identify the correct Local Controller for a
device, without you having to add each Local Controller. When you add a Global Controller, do
not add the individual Local Controllers monitored by the Global Controller.
Click Retrieve From Device to get the server’s authentication certificate. Click Accept when the
certificate is presented to you.
Click OK when finished. The New CS-MARS Device dialog box closes and the server is added to the
CS-MARS device list.
Step 4 From the When Launching CS-MARS list, choose whether you want users to be prompted to log in to
the CS-MARS server when they request event status, or whether Security Manager should automatically
log in to CS-MARS using the credentials provided when the user logged in to Security Manager.
If you elect to use Security Manager credentials, the necessary user accounts must be configured in
CS-MARS. Refer to the CS-MARS documentation for more information.
Step 5 Click Save on the CS-MARS page to save your changes.
Discovering or Changing the CS-MARS Controllers for a Device
If you use the Cisco Security Monitoring, Analysis and Response System (CS-MARS) controllers to
monitor devices, you can register them in Security Manager and then view syslogs and events that are
related to firewall access or IPS signature rules for individual devices.
Security Manager can automatically discover the CS-MARS controllers that monitor a device when you
try to view events related to a rule. If more than one controller monitors a device, you are prompted to
select which controller to use.
You can also proactively select the CS-MARS controller for a device in its Device Properties window.
Similarly, if you ever need to change the CS-MARS controller assigned to a device, you can change the
selection in its Device Properties window. This procedure explains how to discover or change the
CS-MARS controller for a device from its Device Properties window.
Before You Begin
The CS-MARS controller that monitors the device must already be registered with Security Manager on
the CS-MARS administration page (Tools > Security Manager Administration > CS-MARS). For
more information, see Registering CS-MARS Servers in Security Manager, page 69-24.
Step 1 In Device view, do one of the following in the Device selector to open the Device Properties dialog box:
• Double-click a device.
• Right-click a device and choose Device Properties.
• Select a device and choose Tools > Device Properties.