Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Differences: SIMS vs MARS

Hi,

Can someone explain the fundamental differences between the SIMS and MARS product\solutions ?

As far as i have read, they appear quite similar.

Regards,

Naman

1 ACCEPTED SOLUTION

Accepted Solutions
Silver

Re: Differences: SIMS vs MARS

I am cut-pasting the Q&A from the Cisco Website.

What is the difference between Cisco Security Monitoring, Analysis and Response System (MARS), and CiscoWorks SIMS?

A. Cisco Security MARS is the appliance-based product line and CiscoWorks SIMS is the software-based product line. The two products have unique functions and capabilities that can meet customers' different needs. Customers can contact Cisco security sales representatives for respective detailed product information.

Q. Are Cisco Security MARS and CiscoWorks SIMS competing products?

A. No. Both products have been successfully deployed in their respective customers. Cisco customers from different market segments (commercial, medium enterprises, large and global enterprises, and managed security service providers) have found these two products are well positioned to meet their specific security monitoring and mitigation needs. Customers can contact Cisco security sales representatives for assistance.

Visit this URL for more information:

http://www.cisco.com/en/US/products/sw/cscowork/ps5209/products_qanda_item0900aecd802d295e.shtml

5 REPLIES
Silver

Re: Differences: SIMS vs MARS

I am cut-pasting the Q&A from the Cisco Website.

What is the difference between Cisco Security Monitoring, Analysis and Response System (MARS), and CiscoWorks SIMS?

A. Cisco Security MARS is the appliance-based product line and CiscoWorks SIMS is the software-based product line. The two products have unique functions and capabilities that can meet customers' different needs. Customers can contact Cisco security sales representatives for respective detailed product information.

Q. Are Cisco Security MARS and CiscoWorks SIMS competing products?

A. No. Both products have been successfully deployed in their respective customers. Cisco customers from different market segments (commercial, medium enterprises, large and global enterprises, and managed security service providers) have found these two products are well positioned to meet their specific security monitoring and mitigation needs. Customers can contact Cisco security sales representatives for assistance.

Visit this URL for more information:

http://www.cisco.com/en/US/products/sw/cscowork/ps5209/products_qanda_item0900aecd802d295e.shtml

New Member

Re: Differences: SIMS vs MARS

It's been about a year since this original post. I too am looking for a comparison between the two. I've spent about an hour on the net and haven't found more than what is listed above. Does anyone have more detail?

Gold

Re: Differences: SIMS vs MARS

SIMS is re-branded netforensics...so try netforensics.com for information about it. It's been over a year since I've used it, so YMMV. Conceptually it is similar to MARS, it is a Security Information Management product. The reality is that it is a totally different product that AFAICT is developed exclusively by Netforensics. The differences are vast.

IMHO, the most significant drawbacks to SIMS are:

1) correlation is an add-on component

2) licensing is a per-device model

3) requires MUCH more resources to maintain

4) because of the above, SIMS is more expensive to purchase and maintain than CSMARS.

IMHO, the major advantages to SIMS are:

1) broader device support

2) scales "infinitely"

3) supports end-to-end encryption for most event messages

4) user interface is better (java app, not browser based)

New Member

Re: Differences: SIMS vs MARS

Thanks!

I'm new to this forum. I did a search to see if this subject had come up before and it had, so I just added a reply to that thread. I notice the original check mark indicating the problem was solved is still there. Is there way to get rid of that now or should I have started a new thread?

Gold

Re: Differences: SIMS vs MARS

A new thread would have been better, if only because others might not think you have any more unanswered questions. However, it's no big deal either way.

120
Views
0
Helpful
5
Replies
CreatePlease login to create content