Cisco IOS IPS with MARS

There is a demo on Cisco.com, on using IOS IPS configured with Cisco Configuration Professional and MARS.

You can view this HERE.

*************

Want to advertise HERE? Make me an offer.......

*************
*

Cisco NAC Appliance 4.5 Parser Available

Looks like, there is now a draft DSF package for NAC Appliance 4.5 been uploaded to the MARS Package Sharing Exchange.

But my only grievance with this exchange, is that there is no where to tell users what the import passwords are.


Hence one reason, i put the Lancope Stealthwatch 5.7 Package, as an import password of: lancope

So if anyone knows the import pass for the NAC Appliance 4.5 parser, please let me know!

Cisco Netpro MARS Package Sharing

The Netpro Package Sharing facility on Cisco.com, is now open to the public. (previously it hidden, and only truely available by your MARS appliance)

Lets hope this will now encourage people to start sharing rules, reports and of course custom parsers.

Appologies for the lack of postings recently, i`ve been concentrating on getting the Unoffical Cisco Security Agent Blog up and running. Hopefully i`ll put some CSA/MARS articles up soon.

Global Knowledge MARS Training

I see lots of visitors to the MARS blog, looking for training. Jim Thomas, MARS Course Director for Global Knowledge, gives us an insight into their offering below....

"In a truly Self Defending Network, detection and mitigation occur automatically. Alerts come in after the fact for forensic purposes, but all in all, we rest assured that when we leave our business day behind us, the network is protected. This assurance comes forth by acquiring the “best of the breed” software/hardware devices. But just because we have the best device does not necessarily mean we know how to use it, or better yet, use it to its’ maximum capability. MARS is no exception.

We have seen many, many students come through our MARS courses usually from three distinct backgrounds; (1) It’s a brand new install (2) The consultant who installed it came and left (3) We have this box on a rack with pretty blinky lights and need to know how to use it. Whatever the case is, at Global Knowledge being Cisco’s largest training partner for the past 10 years we understand the need to take students through the fundamental to advanced MARS topics and labs.

What sets us apart from other training partners? Mainly the labs and experience you’ll gain working on them. Although we always use Authorized Cisco Curriculum for Student Guides, our labs were designed around real world installations based on experience. We take pride in offering non-virtualized physical MARS appliances to accommodate our student needs.

We constantly enhance our labs by not just updating the MARS itself (we’re currently running 6.0.2), but by going beyond the standard course offerings. An example of this is our Software Reporting Lab, offering students the opportunity to install SNARE and the RPC method of pulling events from a Windows host. Or, by MARS incident generation by means of introducing a live virus to a host in the lab. As Chris has pointed out in this blog, Cisco has been expanding the cross-launch feature between MARS and CSM. We take it a step further in our classes to show the cross-launch with a Cisco IPS/CSM version 3.2 and MARS 6.0.2. These are just a few of our 15 MARS lab offerings we provide to our students.

If you are interested in knowing how to configure and maintain MARS to its maximum potential, please visit the Global Knowledge MARS webpage. If you are interested in learning more about the labs in the class please click here to see the Topology Diagram or here to see our video.

Thanks again,

Jim Thomas

Advanced Security Course Director"

NetFlow Secure Event Logging (NSEL) with MARS

Happy new Year!

You may of heard that the newer ASA 5580`s supported Netflow Secure Event Logging.

Now i`ve never seen this in action, but it may be of interest to see this is supported by MARS..

Check out the links Below...

Configuring NSEL for MARS on the ASA 5580

Configuring and Using NetFlow Secure Event Logging (NSEL)

Cisco ASA 5580 Implementation Note for NetFlow Collectors

On a further note, i believe NetFlow v9 support is limited to parsing and storing only the fields that Cisco Security MARS already parses and stores for NetFlow v5/v7.

Cisco MARS 6.0.2 Now Available

CS-MARS Upgrade Package for 6.0.2 (3102)

Cisco MARS 6.0.2 has been released, with the obvious 3rd Party Signature updates, and a few bug fixes. A summary of the updated Cisco devices support is below...

Miscellaneous Changes and Enhancements

The following changes and enhancements exist in 6.0.2:

•Cisco ASA 8.0.4 support

•Cisco ASA 8.1.2 support

•Cisco IPS 6.1 support

You can check out the release notes for 6.0.2 HERE

Email Alerts based on the Incident Severity

I got asked the question the other day, if it was possible only to receive an email, when Incidents were of the RED Severity.

Now if you think about it, its an option to get an email when an Incident is created, but you cannot be selective if this was RED, AMBER or GREEN.

Now there is a noddy way to achieve this, if you want to go the trouble, and this would be based on duplicating rules...

Consider this RULE below...

If fires based on events received in the Info/UncommonTraffic/Chat and Info/UncommonTraffic/Chat/Proxy groups, but for ANY severity. There is no "Action" defined for this Rule.

If we duplicate the Rule in question, then edit the Severity to be RED Only, then we can apply an Action of email.

If you leave the default rule, to ANY, then you will probably get 2 Incidents Fired, but only 1 email.

So it may be worth changing the default rule, or duplicating again, to set GREEN or YELLOW Severity Events. (You may want to create a second offset, with an OR operation).

You would need to proceed with caution with this method, as the example choosen has only 1 condition to be met. If you select a more complex rule, then you may get in hot water, and render the rule useless!!!

Take care....

Cisco MARS 6.01 Patch Available

Cisco have released a patch, CS-MARS 6.0.1 3070, for users on MARS 6.0.1 release (3066).


Who should apply the Patch

1) Users who have the following devices reporting to MARS: Cisco Switch IOS, Cisco IPS
- User has a Cisco Switch-IOS configured to send syslogs to the MARS (CSCsu94548)
- User downloaded and installed MARS IPS packages S333, S351, or S354 from http://www.cisco.com/cgi-bin/tablebuild.pl/mars-ips-sigup, or configured the dynamic autoupdate utility to download these packages (CSCsu96311)

2) Users who attempt to download raw messages from the database in the GMT+ timezone (CSCsv01999)
3) Users who make use of source/destination port ranking queries (CSCsq48971)


This patch is being released to address four issues

1) CSCsu94548 - None of the Cisco Switch-IOS syslog messages are parsed by MARS
2) CSCsu96311 - Need to fix missing/mis-mapped IPS events in database.
3) CSCsv01999 - Not able to retrieve raw message files using MARS GUI
4) CSCsq48971 - service filter for src/dest port ranking query displays all ports

I suggest you read the readme file before applying.

Netpro Package Sharing

For those, that have not yet upgraded to the latest V6 code of MARS, (and i know thats quite a few!), here are some screenshots of the new Parser Sharing Forum.

With V4/5 and below, there was the concept of the Custom Parser. Beginning with MARS 6.0, these new custom parsing features are referred to as the Device Support Framework (DSF).

With DSF you can quickly add support for new device types, improve support for existing device types, and replicate accomplished work from one CS-MARS appliance to another. (not only device types, but Rules and Reports also)


Device support packages are posted to and downloaded from the Package Sharing page of the MARS forum at the Networking Professionals Connection (NetPro) forum on Cisco.com

These packages can also be protected with an import and unlock password, to prevent you giving the crown jewels away.

As can be seen above, i seem to be the only person to upload so far! :-), but the plan would be to have much more content.

Another cool feature, is that you can also subscribe to the forum, and get updated, when new content is added.

I have created a test Microsoft IIS 6.0 FTP Parser DSF File, which i will upload next week. You can test this out, then start adding your own content, and get the community going.

There are a few other parsers also in development, but more on these soon.

MARS 6.0.1 Now Available

Cisco MARS 6.0.1 is now available to download from CCO.

Documentation Links below....

Device Configuration Guide for Cisco Security MARS, Release 6.x

Cisco Security MARS Initial Configuration and Upgrade Guide, 6.X

Cisco Security MARS Hardware Installation and Maintenance Guide 6.X

User Guide for Cisco Security MARS Local and Global Controllers, Release 6.x

Cisco Security MARS Command Reference, 6.X

Supported and Interoperable Devices and Software for Cisco Security MARS Local Controller 6.0.x

Supported and Interoperable Devices and Software for Cisco Security MARS Global Controller 6.0.x