Cisco have published a new Deployment Guide for CS-MARS.
This document provides guidance on how to best deploy Cisco® Security Monitoring Analysis and Response System (MARS), an appliance-based, all-inclusive solution that provides unmatched insight and control of your existing security deployment. It discusses, among other topics, how to position the appliance in your network, how to tune it, and how to implement a distributed scenario.

This document is for security engineers, network engineers, engineering managers, and the network and security operations staff that plan, design, and implement security monitoring with MARS.
The document is based on a MARS 4.2.x release.
This document provides guidance on how to best deploy Cisco® Security Monitoring Analysis and Response System (MARS), an appliance-based, all-inclusive solution that provides unmatched insight and control of your existing security deployment. It discusses, among other topics, how to position the appliance in your network, how to tune it, and how to implement a distributed scenario.

This document is for security engineers, network engineers, engineering managers, and the network and security operations staff that plan, design, and implement security monitoring with MARS.
The document is based on a MARS 4.2.x release.

