Overview

Cisco Systems offers the Mitigation and Response System (MARS) family of high performance, scalable appliances for threat management, monitoring and mitigation, enabling customers to make more effective use of network and security devices by combining network intelligence, context correlation, vector analysis, anomaly detection, hotspot identification and automated mitigation capabilities. CS MARS solutions empower customers to readily and accurately identify, manage and eliminate network attacks and maintain network compliance. 

Who Should Attend

• Customer
• Channel Partner
• Reseller
• Employee

Cisco Career Certifications

This course is part of the following Certifications:

• CCSP (Cisco Certified Security Professional)

Course Outline

This 2-day course is geared towards obtaining hands-on experience only; therefore, there is no exam.

• MARS Introduction and Task Flow / Provide overview of MARS technology and STM Task Flow Overview.
• Lab 1-1 Accessing MARS 20 appliance.
• Configuring MARS,Configure administration tasks in the MARS system using User Interface.
• Lab 2-1 Adding Cisco Reporting Devices into MARS
• Lab 2-2 Adding non-Cisco Reporting Devices into MARS
• MARS Incident Investigation Configure MARS for incident investigation, create query and send alerts.
• Lab 3-1 Generating Summary Reports
• Lab 3-2 Configure appliance to perform Incident Investigation and attack mitigation.
• Lab 3-3 Creating Queries and Reports.
• MARS Rules and Management Use MARS User Interface to configure rules, management and system maintenance features.
• Lab 4-1 Distributed Threat Mitigation Lab
• Lab 4-2 Create a Custom Parser
• MARS Global Controller, Provide overview of MARS Global Controller

Course Objectives

After completing this course the delegate will be able to: 

• Describe the MARS solution, features and functions in context to the issues of security incidents and security information in an enterprise network.
• Cover the basic physical installation process.
• Add Cisco security and network devices into MARS appliance.
• Add Non-Cisco security and network devices into MARS appliance.
• Configure security devices to generate interesting events that constitute an attack scenario and have MARS collect the interesting events for incident investigation.
• Discuss attack mitigation and false positive confirmation in context to MARS appliance.
• Configure appliance to perform Incident Investigation and attack mitigation.
• Explain how to create, view and save a long-duration query and reports on the MARS appliance.
• Configure the MARS appliance to send an alert.
• Describe and configure rules that detect interesting patterns of network activity.
• Use management features in the MARS appliance to assign event, addressing, service, and user information.
• Configure hardware maintenance chores like viewing audit trail, data archiving, hot swapping hard drives, upgrading software on MARS appliance.
• Provide overview of MARS Global Controller.
• Provide overview of Log Parser Templates.

Prerequisites

Students should also have fundamental knowledge of implementing network security and working knowledge of routing and switching. The following or equivalent knowledge is required before taking this course:

Interconnecting Cisco Networking Devices Part 1 (ICND1) 
Interconnecting Cisco Networking Devices Part 2 (ICND2)