Differences: SIMS vs MARS

[mnlatif]

Hi,

Can someone explain the fundamental differences between the SIMS and MARS product\solutions ?

As far as i have read, they appear quite similar.

Regards,

Naman

[wong34539 · Accepted solution]

I am cut-pasting the Q&A from the Cisco Website.

What is the difference between Cisco Security Monitoring, Analysis and Response System (MARS), and CiscoWorks SIMS?

A. Cisco Security MARS is the appliance-based product line and CiscoWorks SIMS is the software-based product line. The two products have unique functions and capabilities that can meet customers' different needs. Customers can contact Cisco security sales representatives for respective detailed product information.

Q. Are Cisco Security MARS and CiscoWorks SIMS competing products?

A. No. Both products have been successfully deployed in their respective customers. Cisco customers from different market segments (commercial, medium enterprises, large and global enterprises, and managed security service providers) have found these two products are well positioned to meet their specific security monitoring and mitigation needs. Customers can contact Cisco security sales representatives for assistance.

Visit this URL for more information:

http://www.cisco.com/en/US/products/sw/cscowork/ps5209/products_qanda_item0900aecd802d295e.shtml

[jwitek-01]

It's been about a year since this original post. I too am looking for a comparison between the two. I've spent about an hour on the net and haven't found more than what is listed above. Does anyone have more detail?

[mhellman]

SIMS is re-branded netforensics...so try netforensics.com for information about it. It's been over a year since I've used it, so YMMV. Conceptually it is similar to MARS, it is a Security Information Management product. The reality is that it is a totally different product that AFAICT is developed exclusively by Netforensics. The differences are vast.

IMHO, the most significant drawbacks to SIMS are:

1) correlation is an add-on component

2) licensing is a per-device model

3) requires MUCH more resources to maintain

4) because of the above, SIMS is more expensive to purchase and maintain than CSMARS.

IMHO, the major advantages to SIMS are:

1) broader device support

2) scales "infinitely"

3) supports end-to-end encryption for most event messages

4) user interface is better (java app, not browser based)

[jwitek-01]

Thanks!

I'm new to this forum. I did a search to see if this subject had come up before and it had, so I just added a reply to that thread. I notice the original check mark indicating the problem was solved is still there. Is there way to get rid of that now or should I have started a new thread?

[mhellman]

A new thread would have been better, if only because others might not think you have any more unanswered questions. However, it's no big deal either way.