IDS: How to monitor?

[ahpark78]

HI,

Just wanna to know what is the good approach on IDS management?

Any ideas?

tks

ken

[Collin Clark]

Do you mean product or policy? If you're talking product, CS-MARS hands down. Policy needs to come from the security team.

[sundar.palaniappan]

Ken,

There are couple of ways you can monitor IDS/IPS. IEV - IDS Event Viewer - can be used if you have less than five sensors to monitor. If you intend to monitor more than five sensors or looking for more functionality then CS-MARS - Cisco Security Monitoring, Analysis and Response System - is what you need.

HTH

Sundar