09-17-2010 06:04 AM
Hi,
Does anybody know what are the capabilities of MARS to support Imperva FireWalls? Maybe someone has this type of FW in their MARS environment? I am concerning about pulling as much info as possible to CS-MARS from this device. I would appreciate if some would share their experience with me.
Regards,
GP
Solved! Go to Solution.
09-18-2010 06:52 AM
GP;
CS-MARS does not natively support the Imperva firewall. This means out-of-the-box, CS-MARS cannot parse any messages received by this device. You could create your own custom device using the CS-MARS Device Support Framework (DSF). This requires creating custom parsers for the various messages you wish to have CS-MARS parse and map to a CS-MARS event. This process is outlined here:
There is also a custom device package sharing forum here in the community:
https://supportforums.cisco.com/community/netpro/security/mars-pkg?view=discussions
I do not currently see any discussion in that forum regarding the Imperva firewall.
Scott
09-18-2010 06:52 AM
GP;
CS-MARS does not natively support the Imperva firewall. This means out-of-the-box, CS-MARS cannot parse any messages received by this device. You could create your own custom device using the CS-MARS Device Support Framework (DSF). This requires creating custom parsers for the various messages you wish to have CS-MARS parse and map to a CS-MARS event. This process is outlined here:
There is also a custom device package sharing forum here in the community:
https://supportforums.cisco.com/community/netpro/security/mars-pkg?view=discussions
I do not currently see any discussion in that forum regarding the Imperva firewall.
Scott
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: