Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

mars and snare question

have set up snare on a windows server for a customer and I can get reports indicating that the data is sent to the mars box, however, I don't know enough about this to determine what would trigger and incident on mars. Is there a way to make this happen?

1 REPLY
Gold

Re: mars and snare question

manually map a hidden admin share and use invalid credentials multiple times. That should generate an incident.

\\servername\c$

133
Views
0
Helpful
1
Replies
CreatePlease to create content