×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

How to generate a custom report for attacks on Cisco Secure-Monitoring Analysis and Response System (CS-MARS)

Document

Wed, 11/18/2009 - 18:23
Jun 22nd, 2009
User Badges:
  • Gold, 750 points or more

Resolution

Complete these steps to create a custome report for attacks on CS-MARS:

  1. Go to the Query Page and choose Attacks > All > Top Destinations (Total View).

  2. In the page that appears, click on Query Type: Destination IPs Ranked By Sessions (or click on the white [Edit] button in the green box).

  3. In the Result Format box, choose All Matching Sessions, Customer Columns.

  4. Choose the columns that you want to appear in the report. Make sure Reporting Device is the last column.

  5. In Filter by Time, choose the option you want.

  6. Click Apply.

  7. Click Save As Report.

  8. Give the report a name and description.

  9. Click Next.


Note: You can also add/remove event types from the Query if you need to.


For additional help on CS-MARS, refer  Administering the MARS appliance 


For details  of all versions, refer to the CS-MARS release notes.
Loading.

Actions

This Document

Related Content