MARS and IPS updating

Unanswered Question
Mar 20th, 2009

If I enable automatic signature updates on our IPS module, is it possible for an alert to be sent to Cisco MARS indicating that an update took place?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Anonymous (not verified) Thu, 03/26/2009 - 14:52

If the signature actions are correctly configured, MARS can display the trigger packet information for the first event that fires a signature on a Cisco IDS or IPS device. MARS is also able to pull the IP log data from Cisco IDS and IPS devices, however, this operation is system intensive. Therefore, you should select the set of signatures that generate IP log data carefully.


This Discussion