Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Incident...what incident?

I run the report 'activity:attacks seen - Top reporting devices' every hour... So I see which devices have the most incidents and now i want to know what they are. Well, there is no link to take me to them. So I log into MARS...now what? If i go to the incidents tab it shows me all of the events...but no details. So I have to click on each event?

Mars needs more drill down. Has anyone else run into this or found a way around it?

1 REPLY
Silver

Re: Incident...what incident?

When you click the Incident ID, the Incident Details table appears in a separate browser connected to the Local Controller that recorded the event.

Each row of the Incident Details table represents either a session or the information common to a group of sessions. You can see all of the collapsed session information by clicking the plus signs to expand the group. You can expand or collapse all of the incident's information by clicking the Expand All orCollapse All buttons.

For the further description following URL may help you

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/user/guide/combo/invest.html#wp800363

143
Views
0
Helpful
1
Replies