-
User Guide for Cisco Security MARS Global Controller, Release 5.2.x
-
Preface
-
Introduction
-
Configuring the Global Controller
-
Network Summary
-
Case Management
-
Incident Investigation and Mitigation
-
Queries and Reports
-
Rules
-
Sending Alerts
-
Management Tab Overview
-
System Maintenance
-
Cisco Security MARS XML API Reference
-
Regular Expression Reference
-
Date/Time Format Specfication
-
System Rules and Reports Reference
-
Glossary
-
Index
-
Table Of Contents
Configuring the Global Controller
Importing the Security Certificates
Monitoring Local Controller Events from the Global Controller
Preparing to Add and Discover Devices
Configuring the Global Controller
Once you have performed the configuration tasks described in this chapter, a Global Controller administrator can create, edit, or delete user-defined settings and rules on the Global Controller and its monitored Local Controllers. These settings and rules include:
•
Rules
•
•
To configure the Global Controller, you must perform several tasks before you can monitor the events and incidents reported by Local Controllers:
1.
2.
3.
4.
Note
5.
6.
:
22
Secure Shell (SSH)
443
Hyper Text Transport Protocol with Secure Sockets Layer (HTTPS)
8444
Cisco Proprietary data synchronization with Local Controlle r
This chapter contains the following topics:
•
•
•
•
Adding Local Controllers
Follow these steps to add a Local Controller to the Global Controller:
Step 1
Figure 2-1 Zone Controller Information Page
Step 2
A pop-up window appears in which you can add a Local Controller to the Global Controller.
Figure 2-2 Local Controller Information Page
Step 3
•
•
•
Step 4
Before the Global Controller can communicate with the Local Controller, you must import the security certificate into the Global Controller. For more information, see Importing the Security Certificates.
Topology Synchronization
For the Global Controller to display a summarized and merged view of topology for its Local Controllers, topology data from all the Local Controllers must be pushed to the Global Controller. When you add a Local Controller to a Global Controller, the topology synchronization process begins and completes automatically.
When synchronized with Local Controllers, the Global Controller contains all the security and monitoring information of the Local Controllers (as displayed on Admin > System Maintenance > Security and Monitor Devices) and can display the combined topological maps of the Local Controllers with the following constraints:
•
•
Topo Sync Start/Stop
When you change Local Controller topology or it otherwise becomes out-of-sync, you can re-synchronize the Local Controller and Global Controller by clicking Topo Sync Start/Stop on the Zone Controller Information Page. The Status field reports the current state of the synchronization process. Table 2-1 lists and describes all possible status messages.
An out-of-sync condition can occur when unexpected errors or events (device, software, network, etc.) disrupt communication between the Local and Global Controllers.
Suspend/Resume
The Suspend/Resume button toggles the communication link on and off between the Global Controller and the Local Controller. When suspended, the Local Controller cannot communicate with the Global Controller.
Note
Deleting Local Controllers
To delete a Local Controller from the Global Controller and return the Local Controller to Standalone mode, do the following steps:
Step 1
Figure 2-3 Zone Controller Information Page
Step 2
A Yes/No confirmation dialog box appears. Click Yes to remove configuration info and data from the Global and Local Controllers.
If the status of the Local Controller is Not Responding, a Continue/Cancel dialog box appears. Because the Global Controller cannot communicate with the Local Controller, clicking Continue removes only the Local Controller data from the Global Controller. To remove the Global Controller configuration information from the Local Controller, you must execute a pnreset -s CLI command on the Local Controller as explained in the following URL:
Note
The duration of the deletion process varies with the amount of data to be deleted. A duration of many minutes is possible.
Importing the Security Certificates
Security certificates are used for secure communications between a web browser and the Global Controller, as well as between the Global Controller and any Local Controllers that are managed by the Global Controller. Every Global Controller comes with a default certificate which is unique to each Global Controller. However, users could choose to modify the default certificate using the
sslcertCLI command. For more information on using the sslcert command, see sslcert, in the Install and Setup Guide for Cisco Security Monitoring, Analysis, and Response System.Figure 2-4 Changing the Default Security Certificate
If you wish to install the certificate to an Internet Explorer browser, you must do it during the Global Controller login process.
When the Security Alert pop up appears, choose:
Step 1
Step 2
Step 3
Step 4
Step 5
Figure 2-5 Global Controller Login Security Alert
The security certificate is used for communication between a Global Controller and any Local Controllers that are managed by the Global Controller.
Although Global Controller and Local Controllers have default security certificates, the Global Controller certificate will need to be exported to all the Local Controllers manually. And all Local Controllers certificates will need to be exported to Global Controller.
To install a Global Controller security certificate on to Local Controllers, follow these steps:
Step 1
Step 2
Figure 2-6 Copy the Global Controller Security Certificate
Step 3
Step 4
Step 5
Figure 2-7 Apply the Global Controller Certificate to the Local Controller
To install a Local Controller security certificate on to the Global Controller, follow these steps:
Step 1
Step 2
Figure 2-8 Copy the Local Controller Security Certificate
Step 3
Step 4
Figure 2-9 Select the Appropriate Local Controller
Step 5
Step 6
Figure 2-10 Apply the Local Controller Certificate to the Global Controller
Monitoring Local Controller Events from the Global Controller
The various Local Controllers send summarized information to the Global Controller, which in turn compiles and collates it. There may be a reason you want to suspend, or temporarily hold back, information being sent from one of the Local Controllers. For example, if several of the Local Controller zones are compromised and sending many events at once, you may want to focus on isolating problems on one Local Controller at a time.
If you want to suspend the transmission of information from a Local Controller, follow these instructions:
Step 1
Step 2
The Local Controller you selected disappears from the list of active Local Controllers, and its output is buffered until you select it and click Suspend/Resume again.
Follow the same procedure to resume output from the affected Local Controller.
Preparing to Add and Discover Devices
Before configuring the Global Controller to recognize reporting devices, be aware of the levels of operation supported by a Local Controller. To learn more about the levels of operation for the Local Controller s, see Levels of Operation, in the User Guide for Cisco Security MARS Local Controller
Adding Reporting Devices
After you have added the Global Controller's configuration information and rebooted it, you need to configure the third-party devices that report to the Global Controller. All of the event information that passes through these devices is distilled down and sessionized to the information that the Global Controller presents to you. The more information that you can provide for these devices, the clearer the picture you'll get when using the Global Controller.
Note
Manual Configuration
In general, you have two choices for adding devices that you want to monitor into your Global Controller. You can create a seed file or you can add each device manually. Seed file support is limited to a few device types; see Configuring Supported Devices.
When manually configuring devices, select the devices that are most interesting to you. Once added, you can come back and edit them as necessary. Manual configuration is also useful when you add or change a single security device on your network. See Configuring Supported Devices for more information about configuring individual devices.
Note
Add a Device Manually
Step 1
Figure 2-11 Selecting the Local Controller Zone
Step 2
Figure 2-12 Entering the Device on the Local Controller
Step 3
Step 4
Step 5
Newly added devices on the Local Controller are automatically discovered by the Global Controller.
For more information on installing individual devices, see Preparing to Add and Discover Devices.
Configuring Supported Devices
For most of the security and monitoring devices that you have report to Global Controller, set up and configuration is three-part. You need to:
•
•
•
For devices that use agents, modules, or sensors, you need to perform a couple of extra steps.
L2 Discovery and Mitigation
For information on L2 device discovery and mitigation, see Layer 2 Discovery and Mitigation, page 2-29 in the User Guide for Cisco Security MARS Local Controller.
