Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

Using IPS 6.3 customized signatures in CS MARS

A client has a Cisco IPS 6.3 module installed in a Catalyst 6500, *with fully customized signatures* which generate thousands of alerts clearly visible in its IPS Event Viewer.

MARS is pulling info from that IPS, but the customized signatures do not appear in any Incident. Is it possible for MARS to pull all those customized signatures??

Thanks in advance

2 REPLIES
Gold

Re: Using IPS 6.3 customized signatures in CS MARS

The first step is to get MARS to parse the event. The next step is to create the necessary inspection rules.

You can start here:

http://ciscomars.blogspot.com/2008/03/custom-ips-signatures-with-cisco-mars.html

Community Member

Re: Using IPS 6.3 customized signatures in CS MARS

Thank you very much Mr. I'll give it a try.

131
Views
0
Helpful
2
Replies
CreatePlease to create content