MARS

Please note:
This course is part of the CCSP certification which has been replaced by CCNP Security.
Detailed transition information

The Cisco Security Mitigation and Response System (CS MARS) is a family of appliances permitting a systematic management of security-relevant events in the network. MARS summarizes the reports of many devices in the network, puts them into an overall context, detects anomalies, and applies methods which serve to automatically react on threats and to delimit their effects. MARS can be understood as a management-based intrusion detection and prevention system, which can influence and control the devices in the network by means of policies. The contents of the seminar prepare the student for test no. 642-544 (MARS), which can be passed in the context of a certification as CCSP as an alternative to the 642-591 (CANAC) or 642-513 (HIPS) examinations.

Course Contents
• Introduction to MARS and Task Flows
• Access to Appliance
• Configuration with the User Interface: Management and Maintenance
• MARS Rules
• Integration of the Cisco Reporting Devices into MARS
• Integration of the Reporting Devices of Other Vendors into MARS
• Examination of Incidents in the Network-MARS Incident Investigation
• Queries, Send Alerts, and Reports
• Creation of Summary Reports
• Configuration of Incident Investigation and Attack Mitigation
• Distributed Threat Mitigation
• Creation of an Adapted Parser
• The MARS Global Controller

In this course, each student will receive the original Cisco Systems course documentation in English language.

Target Group
The course addresses persons who wish to plan the application of MARS or to configure and operate the appliance.

Knowledge Prerequisites
General know-how about the handling of Cisco routers and switches on the level of a CCNA®, as well as a thorough knowledge of network security (e.g. CCSP®) are required.

MARS