Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

MARS and IDSM2 logs

Hi All,

I have MARS version 6.0.3 (3188) 32, when i try to add IDSM2 to it as a device i can't find the version of the IDSM2 in the MARS.

version of IDSM2 is  7.0.4(E4).

can anyone help me in this issue please.

Thanks in advance,

Ayman

2 ACCEPTED SOLUTIONS

Accepted Solutions
Cisco Employee

Re: MARS and IDSM2 logs

Aymen;

The upgrade process for CS-MARS is outlined here:

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/initial/configuration/upgrade.html

The upgrade does not affect your existing configuration and incident data.

A standalone CS-MARS is the equivalent of a local controller in this

document.

Scott

Cisco Employee

Re: MARS and IDSM2 logs

Ayman;

CS-MARS will successfully parse signature events for your IDSM-2

running 7.0 software. However, CS-MARS will have no understanding of

the global correlation details which are new to the 7.0 release. If you

wish to be able to query/report on global correlation details within

CS-MARS, you will need to upgrade.

Once you upgrade, you can simply select the IDSM-2 in the 'Security

and Monitor Devices' list and click the "Change Version" button.

Scott

5 REPLIES
Cisco Employee

Re: MARS and IDSM2 logs

IPS 7.0 support was added in CS-MARS release 6.0.4.

Scott

New Member

Re: MARS and IDSM2 logs

HI Scott,

How can i upgrade from 6.0.3 to 6.0.4 and does the upgrade of the MARS will affect the configuration or not ???

Thanks in advance

Ayman Yehia

Cisco Employee

Re: MARS and IDSM2 logs

Aymen;

The upgrade process for CS-MARS is outlined here:

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/initial/configuration/upgrade.html

The upgrade does not affect your existing configuration and incident data.

A standalone CS-MARS is the equivalent of a local controller in this

document.

Scott

New Member

Re: MARS and IDSM2 logs

Hi Scott,

Thanks for the links but i managed to add the IPS as version 6 and it worked fine with the MARS.

Thanks

Ayman

Cisco Employee

Re: MARS and IDSM2 logs

Ayman;

CS-MARS will successfully parse signature events for your IDSM-2

running 7.0 software. However, CS-MARS will have no understanding of

the global correlation details which are new to the 7.0 release. If you

wish to be able to query/report on global correlation details within

CS-MARS, you will need to upgrade.

Once you upgrade, you can simply select the IDSM-2 in the 'Security

and Monitor Devices' list and click the "Change Version" button.

Scott

502
Views
15
Helpful
5
Replies
CreatePlease login to create content