Apart from going down the VMS route, there are essentially two options, the first is not really applicable in your case:
Cisco offers two security agent options: Cisco Security Agent (CSA) for Cisco CallManager and Management Center for Cisco Security Agent (CSA MC).
CSA for Cisco CallManager comprises a standalone agent and security policy that is designed to be used on all servers in the voice cluster. Because the policy that is included with this agent is configured specifically for Cisco CallManager and other Cisco IP telephony applications, you cannot update or view it.
If you want to add, change, delete, or view rules and policies that CSA for Cisco CallManager includes, or if you want to add support for non-Cisco approved, third-party applications, you must purchase and install the fully managed console, CSA MC. CSA MC requires a separate, dedicated server to be used as the management center. This management center allows you to create agent kits that are then distributed to agents that are installed on other network systems and servers.