CS-MARS Request: Filter dashboard attack diagram

hoffa2000 · ‎08-17-2007

On my setup the attack diagram displays green events as well as yellow and red, thus giving a very cluttered graph.

Unless this feature is already implemented I would like to have the option to filter the events shown in the attack diagram and only see the red ones.

As I understand one option is to have MARS drop the green events using drop rules but I don't like this idea and would much rather have MARS filter whats shown instead of whats processed.

What do you folks think?

Regards

Fredrik Hofgren

dsweeny · ‎08-23-2007

I think MARS can filter out events. Following links may help you

http://www.cisco.com/en/US/products/ps6241/products_user_guide_chapter09186a008083e3d0.html

http://www.cisco.com/en/US/products/ps6241/products_user_guide_chapter09186a008084f08a.html

hoffa2000 · ‎08-23-2007

Yes. MARS can filter events in the event manager as the first link shows. However this does not change the way incidents are displayed in the attack diagram.