Cisco MARS 6.0.1 Release Notes

Thanks to a post in the Cisco MARS User Group , the Release notes for MARS 6.0.1 are now available on Cisco.com

A snippet below, shows the updated on box, vendor sigs....

You can also find, a Migrating Data from Cisco Security MARS 4.x to 6.0.1, document HERE.

ASK THE EXPERT - CS-MARS

Not sure if anyone has seen this, but there is a current "Ask the Expert" series, running on the Netpro forums, on MARS.

Looking at the discussions, it looks like MARS 6.0 will be out by the end of September.

Fortinet Custom Parsing

Sorry for the lack of posts recently, i`ve been busy....

• With work....
  
• Studying for the CCIE!
• I got married
• Went on Honeymoon to Mexico and the USA.

And apart from the above, i`ve been patiently waiting for MARS v6 to be released!

So whats new?

Well thanks to everyone who has sent me the link to the article below...

Sebastian from the Firewall Guru Blog has posted an article, on how to create a custom parser to get MARS to understand some Fortinet events..

Go check it out...

Cisco MARS 4.3.6 and 5.3.6 released

Cisco have yesterday released MARS 4.3.6 and 5.3.6.

Theres no new features in this release, but a major fix.

The following changes and enhancements exist in 4.3.6 and 5.3.6:

•Resolution of issue introduced in x.3.4 release. The driver for the x.3.6 release is to correct CSCsr47032, a defect introduced in x.3.4 that results in the database gradually filling up with unneeded audit logs. This defect can lead to a file system overflow when archiving is enabled or exporting is used for migration purposes.

Customers should upgrade to the x.3.6 release soon as possible to avoid consuming all hard drive space on CS-MARS 20/20R, 25/25R, 50, and 55 models. High-end models are not in danger of disk overflow but may experience a malfunction of archiving and export depending on the quantity of accumulated audit logs.

To determine whether an appliance is affected by this defect, click ADMIN > System Maintenance >View the Audit Trail, and look for messages like "8/18/08 3:50:11 PM PDT Unknown User (unknown) Database insert: DbReportResult: DbReportResult:215178". If thousands of such messages appear from the previous hour, an upgrade to x.3.6 is strongly recommende.

Release notes for 4.3.6 are available HERE.

Release notes for 5.3.6 are available HERE.

MARS Canned Reports

I know I have posted on this before, but newer readers may not have seen this document.

On the Cisco Learning Network, there is a PDF Doc, that lists the various compliance requirements, and the reports in Cisco MARS that can help meet that objective.

Emulation Links Added

I`ve added a new links section named "Cisco Emulation" to the blog.

As you may know i`m currently studying for the CCIE Security. If your in the same boat as me, there are some great sites out there you should be aware of. Go check them out!

The Cisco Learning Network Launched

Cisco has launched the new Cisco Learning Network. This is a great new online community of Cisco learning professionals, looking to gain training and support on the various Cisco Qualifications and Technologies.

Sign up with an account, and you gain access to short CBT style training segments, PDF documents, discussions, career advise, certification information, plus much more.

In relation to Cisco MARS, on the site you will find 2 or 3 great training segments, or Quick Learning Modules as Cisco calls them, as shown below...


In more detail...


I`d recommend, you go check them out!

Cisco MARS 4.3.5 and 5.3.5 Out Now

Appologies for the lack of posts recently, i`ve been overloaded with PIX/VPN3000 to ASA Migrations, and Cisco Security Manager jobs.

Anyhow, Cisco have just released MARS 4.3.5 and 5.3.5, so whats new?

Miscellaneous Changes and Enhancements

The following changes and enhancements exist in 4.3.5:

•Update to intrusion prevention, and intrusion detection, and vulnerability assessment signature sets.

•Bug fixes. For the list of resolved issues, see Resolved Caveats - Release 4.3.5.

You can view the Release notes for 4.3.5 HERE, and 5.3.5 HERE.

New Cisco NetPro Forum

Cisco have introduced a new section dedicated to MARS on the Netpro Forums on Cisco.com

"Welcome to the Cisco Networking Professionals Cisco Security MARS Forum. This conversation will provide you the opportunity to discuss the product, solutions and issues surrounding Cisco Security MARS deployments, maintenance and integration. We encourage everyone to share their knowledge and start conversations about topics involving the Cisco Security MARS. Remember, just like in the workplace, be courteous to your fellow forum participants. Please refrain from using disparaging or obscene language or posting advertisements. We encourage you to tell your fellow networking professionals about the site. Dan Bruhn NetPro Community Manager"

You can link straight to the forum HERE.

MARS 20,20R and 50 EOL Announced

"Cisco® announces the end-of-sale and end-of life dates for the Cisco Security Monitoring, Analysis and Response System (MARS) 20R/20/50 Appliances. The last day to order the affected product(s) is July 31, 2008."

Full details of this announcment can be found here