Currently, I have some trouble in CS-MARS, and hope anyone can give me some suggestion.
Recently, we upgrade the IDS from McAfee 4.x -> 5.x. However, it was not on the support list of the CS-MARS.
The way to solve it was to create a new custom device in the CS-MARS 6.x. However, there are over 4000 event types need to be associated for the devices.
Therefore, does any easy way to do it?
Thanks for any recommandation.