09-17-2010 06:04 AM
Hi,
Does anybody know what are the capabilities of MARS to support Imperva FireWalls? Maybe someone has this type of FW in their MARS environment? I am concerning about pulling as much info as possible to CS-MARS from this device. I would appreciate if some would share their experience with me.
Regards,
GP
Solved! Go to Solution.
09-18-2010 06:52 AM
GP;
CS-MARS does not natively support the Imperva firewall. This means out-of-the-box, CS-MARS cannot parse any messages received by this device. You could create your own custom device using the CS-MARS Device Support Framework (DSF). This requires creating custom parsers for the various messages you wish to have CS-MARS parse and map to a CS-MARS event. This process is outlined here:
There is also a custom device package sharing forum here in the community:
https://supportforums.cisco.com/community/netpro/security/mars-pkg?view=discussions
I do not currently see any discussion in that forum regarding the Imperva firewall.
Scott
09-18-2010 06:52 AM
GP;
CS-MARS does not natively support the Imperva firewall. This means out-of-the-box, CS-MARS cannot parse any messages received by this device. You could create your own custom device using the CS-MARS Device Support Framework (DSF). This requires creating custom parsers for the various messages you wish to have CS-MARS parse and map to a CS-MARS event. This process is outlined here:
There is also a custom device package sharing forum here in the community:
https://supportforums.cisco.com/community/netpro/security/mars-pkg?view=discussions
I do not currently see any discussion in that forum regarding the Imperva firewall.
Scott
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide