Solved: MARS and IDSM2 logs

ayman emara · ‎08-26-2010

Hi All,

I have MARS version 6.0.3 (3188) 32, when i try to add IDSM2 to it as a device i can't find the version of the IDSM2 in the MARS.

version of IDSM2 is 7.0.4(E4).

can anyone help me in this issue please.

Thanks in advance,

Ayman

Scott Fringer · ‎08-30-2010

Aymen;

The upgrade process for CS-MARS is outlined here:

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/initial/configuration/upgrade.html

The upgrade does not affect your existing configuration and incident data.

A standalone CS-MARS is the equivalent of a local controller in this

document.

Scott

View solution in original post

Scott Fringer · ‎09-03-2010

Ayman;

CS-MARS will successfully parse signature events for your IDSM-2

running 7.0 software. However, CS-MARS will have no understanding of

the global correlation details which are new to the 7.0 release. If you

wish to be able to query/report on global correlation details within

CS-MARS, you will need to upgrade.

Once you upgrade, you can simply select the IDSM-2 in the 'Security

and Monitor Devices' list and click the "Change Version" button.

Scott

View solution in original post

Scott Fringer · ‎08-27-2010

IPS 7.0 support was added in CS-MARS release 6.0.4.

Scott

ayman emara · ‎08-29-2010

HI Scott,

How can i upgrade from 6.0.3 to 6.0.4 and does the upgrade of the MARS will affect the configuration or not ???

Thanks in advance

Ayman Yehia

Scott Fringer · ‎08-30-2010

Aymen;

The upgrade process for CS-MARS is outlined here:

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/initial/configuration/upgrade.html

The upgrade does not affect your existing configuration and incident data.

A standalone CS-MARS is the equivalent of a local controller in this

document.

Scott

ayman emara · ‎09-03-2010

Hi Scott,

Thanks for the links but i managed to add the IPS as version 6 and it worked fine with the MARS.

Thanks

Ayman

Scott Fringer · ‎09-03-2010

Ayman;

CS-MARS will successfully parse signature events for your IDSM-2

running 7.0 software. However, CS-MARS will have no understanding of

the global correlation details which are new to the 7.0 release. If you

wish to be able to query/report on global correlation details within

CS-MARS, you will need to upgrade.

Once you upgrade, you can simply select the IDSM-2 in the 'Security

and Monitor Devices' list and click the "Change Version" button.

Scott