This course is designed for:

• Engineers who support sales of Cisco security product solutions
• Cisco channel partners who sell, implement, and maintain secure networks
• Cisco customers who implement and maintain secure networks

Upon completing this course, the learner will be able to meet these overall objectives:

• Describe a Cisco Security MARS solution and its role in Cisco Threat-Defense System management
• Describe the software components of Cisco Security MARS architectural design
• Configure the network reporting devices to work with the Cisco Security MARS appliance
• Describe the key concepts involved in using network reporting and mitigation devices with the Cisco Security MARS appliance
• Use the Summary page to view the security status of your network
• Describe and configure a rule that detects interesting patterns of network activity and other anomalous network behavior
• Describe the process of generating queries and reports in a Cisco Security MARS appliance
• Describe the process of incident investigation on a Cisco Security MARS appliance
• Configure user-defined log parser templates on the Cisco Security MARS appliance
• Integrate Cisco Security Manager and Cisco Security MARS
• Perform system maintenance tasks on the Cisco Security MARS appliance
• Identify common issues about Cisco Security MARS
• Describe the features and functions of the Cisco Security MARS Global Controller
• Summarize the key functionalities of Cisco Security MARS technologies at work

Introducing Cisco Security Monitoring, Analysis, and Response System

• Effective Security Monitoring and Management
• Cisco Self-Defending Network and the Role of Cisco Security MARS
• Cisco Security MARS
• Cisco Security MARS Terminology
• Cisco Security MARS Technologies
• Cisco Security MARS User Interface
• Cisco Security MARS Product Portfolio

Understanding the System Architecture

• Cisco Security MARS Software Components
• Cisco Security MARS Process Flow Details

Configuring a Cisco Security MARS Appliance

• Initial Cisco Configuration Overview
• Deployment Planning Guidelines

Adding Reporting and Mitigation Devices

• Overview of Reporting and Mitigation Devices
• Data-Enabling Features of Cisco Security MARS
• Integrating Cisco Security MARS with Third-Party Applications

Viewing the Summary Page

• Summary Page Overview
• Dashboard
• Network Status
• My Reports

Managing Rules

• Rules Overview
• Working with System and User Inspection Rules
• Working with Drop Rules
• Rule Groups Overview

Understanding Queries and Reports

• Query Page
• Reports Page

Investigating and Mitigating Incidents

• Incidents Overview
• Incidents
• False Positives
• Case Management
• Configuring Notifications

Working with User-Defined Log Parser Templates

• Overview of User-Defined Log Parser Templates

Integrating with Cisco Security Manager

• Overview of Cisco Security Manager Policy Table Lookup

Managing and Administering the System

• Management Overview
• Overview of System Maintenance Tasks
• IPS Signature Dynamic Update Settings
• Upgrading the Cisco Security MARS Appliance Software
• Migrating Data from Cisco Security MARS 4.3.x to 5.3.x

Troubleshooting and Optimizing Cisco Security MARS

• Hardware Installation Issues
• Device Configuration Issues
• Global Controller-to-Local Controller Communications
• Sizing Cisco Security MARS Deployment
• Tuning Cisco Security MARS
• Securing Cisco Security MARS

Using the Cisco Security MARS Global Controller

• Cisco Security MARS Global Controller Overview
• Configuring the Cisco Security MARS Global Controller
• Summary Tab
• Incidents Tab
• Queries and Reports
• Rules Tab
• Management Tab
• System Maintenance Tab