Netpro Package Sharing

For those, that have not yet upgraded to the latest V6 code of MARS, (and i know thats quite a few!), here are some screenshots of the new Parser Sharing Forum.

With V4/5 and below, there was the concept of the Custom Parser. Beginning with MARS 6.0, these new custom parsing features are referred to as the Device Support Framework (DSF).

With DSF you can quickly add support for new device types, improve support for existing device types, and replicate accomplished work from one CS-MARS appliance to another. (not only device types, but Rules and Reports also)


Device support packages are posted to and downloaded from the Package Sharing page of the MARS forum at the Networking Professionals Connection (NetPro) forum on Cisco.com

These packages can also be protected with an import and unlock password, to prevent you giving the crown jewels away.

As can be seen above, i seem to be the only person to upload so far! :-), but the plan would be to have much more content.

Another cool feature, is that you can also subscribe to the forum, and get updated, when new content is added.

I have created a test Microsoft IIS 6.0 FTP Parser DSF File, which i will upload next week. You can test this out, then start adding your own content, and get the community going.

There are a few other parsers also in development, but more on these soon.

MARS 6.0.1 Now Available

Cisco MARS 6.0.1 is now available to download from CCO.

Documentation Links below....

Device Configuration Guide for Cisco Security MARS, Release 6.x

Cisco Security MARS Initial Configuration and Upgrade Guide, 6.X

Cisco Security MARS Hardware Installation and Maintenance Guide 6.X

User Guide for Cisco Security MARS Local and Global Controllers, Release 6.x

Cisco Security MARS Command Reference, 6.X

Supported and Interoperable Devices and Software for Cisco Security MARS Local Controller 6.0.x

Supported and Interoperable Devices and Software for Cisco Security MARS Global Controller 6.0.x

Cisco MARS 6.0.1 Release Notes

Thanks to a post in the Cisco MARS User Group , the Release notes for MARS 6.0.1 are now available on Cisco.com

A snippet below, shows the updated on box, vendor sigs....

You can also find, a Migrating Data from Cisco Security MARS 4.x to 6.0.1, document HERE.

ASK THE EXPERT - CS-MARS

Not sure if anyone has seen this, but there is a current "Ask the Expert" series, running on the Netpro forums, on MARS.

Looking at the discussions, it looks like MARS 6.0 will be out by the end of September.

Fortinet Custom Parsing

Sorry for the lack of posts recently, i`ve been busy....

• With work....
  
• Studying for the CCIE!
• I got married
• Went on Honeymoon to Mexico and the USA.

And apart from the above, i`ve been patiently waiting for MARS v6 to be released!

So whats new?

Well thanks to everyone who has sent me the link to the article below...

Sebastian from the Firewall Guru Blog has posted an article, on how to create a custom parser to get MARS to understand some Fortinet events..

Go check it out...

Cisco MARS 4.3.6 and 5.3.6 released

Cisco have yesterday released MARS 4.3.6 and 5.3.6.

Theres no new features in this release, but a major fix.

The following changes and enhancements exist in 4.3.6 and 5.3.6:

•Resolution of issue introduced in x.3.4 release. The driver for the x.3.6 release is to correct CSCsr47032, a defect introduced in x.3.4 that results in the database gradually filling up with unneeded audit logs. This defect can lead to a file system overflow when archiving is enabled or exporting is used for migration purposes.

Customers should upgrade to the x.3.6 release soon as possible to avoid consuming all hard drive space on CS-MARS 20/20R, 25/25R, 50, and 55 models. High-end models are not in danger of disk overflow but may experience a malfunction of archiving and export depending on the quantity of accumulated audit logs.

To determine whether an appliance is affected by this defect, click ADMIN > System Maintenance >View the Audit Trail, and look for messages like "8/18/08 3:50:11 PM PDT Unknown User (unknown) Database insert: DbReportResult: DbReportResult:215178". If thousands of such messages appear from the previous hour, an upgrade to x.3.6 is strongly recommende.

Release notes for 4.3.6 are available HERE.

Release notes for 5.3.6 are available HERE.

MARS Canned Reports

I know I have posted on this before, but newer readers may not have seen this document.

On the Cisco Learning Network, there is a PDF Doc, that lists the various compliance requirements, and the reports in Cisco MARS that can help meet that objective.

Emulation Links Added

I`ve added a new links section named "Cisco Emulation" to the blog.

As you may know i`m currently studying for the CCIE Security. If your in the same boat as me, there are some great sites out there you should be aware of. Go check them out!

The Cisco Learning Network Launched

Cisco has launched the new Cisco Learning Network. This is a great new online community of Cisco learning professionals, looking to gain training and support on the various Cisco Qualifications and Technologies.

Sign up with an account, and you gain access to short CBT style training segments, PDF documents, discussions, career advise, certification information, plus much more.

In relation to Cisco MARS, on the site you will find 2 or 3 great training segments, or Quick Learning Modules as Cisco calls them, as shown below...


In more detail...


I`d recommend, you go check them out!

Cisco MARS 4.3.5 and 5.3.5 Out Now

Appologies for the lack of posts recently, i`ve been overloaded with PIX/VPN3000 to ASA Migrations, and Cisco Security Manager jobs.

Anyhow, Cisco have just released MARS 4.3.5 and 5.3.5, so whats new?

Miscellaneous Changes and Enhancements

The following changes and enhancements exist in 4.3.5:

•Update to intrusion prevention, and intrusion detection, and vulnerability assessment signature sets.

•Bug fixes. For the list of resolved issues, see Resolved Caveats - Release 4.3.5.

You can view the Release notes for 4.3.5 HERE, and 5.3.5 HERE.