Global Knowledge-Cisco - (Page 50) Updated MARS - Cisco Security Monitoring,Analysis, and Response System v3.0 Course 5731 Cisco Course v3.0 | MARS v4.3.4 | Prepares you for Cisco Exam 642-545 MARS. Course Description Cisco Security Monitoring, Analysis, and Response System (CS-MARS) is a family of high-performance, scalable appliances for threat management, monitoring, and mitigation that enables you to make more effective use of network and security devices by combining network intelligence, context correlation, vector analysis, anomaly detection, hotspot identification, and automated mitigation capabilities. With CS-MARS solutions you can readily and accurately identify, manage, and eliminate network attacks and maintain network compliance. Hands-On Labs Lab 1: Remote Lab Familiarization You will have access to: • Three Microsoft Windows desktop PCs • Six Windows 2003/2000 servers • An ASA 5520 firewall • A Catalyst 3560 L2/L3 switch • Two 2811 IOS routers • The MARS appliance (not virtual) Lab 2: Bootstrapping the MARS • Perform initial login, basic configurations, and command line options • Explore several newer commands available in versions 4.3.4 Lab 3: Importing Hardware Devices into MARS • Exclusive – Use version 4.3.4 of code • Exclusive – Use live Cisco equipment • Perform a manual device entry • Auto Discover devices • Use a Seed File to import devices Lab 4: Generating Summary Reports • Exclusive – Configure the Netflow on the IOS routers • Maneuvering the GUI • Reviewing queries Lab 5: Exploring Rules • Create a basic rule • Investigate an incident to mark as a false positive, creating a drop rule Lab 6: Generating Queries & Reports • Enter appropriate logging commands on an IOS device • Explore newer IOS commands to allow command logging to MARS • Run queries with different search parameters Lab 7: Case Management and Rule Actions • Create a case and have the case e-mailed to a user • Modify the action on a rule to automatically generate an e-mail when the incident is created Lab 8: Incident Handling and Mitigation • Launch an attack against your DMZ from the outside of the network • Investigate the incident and attack vector graphs • Review the recommended mitigation response from MARS Lab 9: Tuning the MARS • Tune networking devices from generating incidents • Investigate an Incident and create a False Positive rule • Explore device-side tuning and appliance-side tuning Lab 10: Creating a Custom Parser • Use tool to provide custom syslog messages so you do not have to fail/penetrate production equipment • Create a custom parser to parse a Barracuda WebFilter log Lab 11: CSM and MARS Interaction • Exclusive – Configure CSM with a Cisco IPS • Add a CSM Server to MARS • Generate an event and have the IPS report the event to MARS • Investigate the event by querying CSM directly from MARS • Review the IPS signature that caused the event directly from MARS Lab 12: IPS and MARS Integration • Load the baseline config into the IPS • Exclusive – Work with IPS version 6.x code directly on a live working IPS Sensor (not a virtual device) • Configure the IPS for SNMP support • Create a MARS account in the IPS • Add the IPS to MARS • Configure Dynamic Signature Updates • Use Command Line options in the IPS to verify MARS is configured correctly Lab 13: Adding a Software Reporting Device • Exclusive – Install the latest SNARE software and configure it • Add a Windows Server as a reporting device using SNARE and RPC • An IIS Server as a reporting device • Exclusive – Add a Symantec AV Server as a reporting device and trigger an event with a virus infection Lab 14: Adding an AAA Reporting Device • Exclusive – Install and configure PNLOGAGENT on the ACS Server • Configure the ACS Server as a reporting device in MARS • Log into an IOS device and see the event in MARS Exclusive – Lab 15: Maintaining the MARS Appliance • Extract raw messages from MARS • Archive Data to a Windows NFS share • Set up NFS on Windows using a Microsoft Utility • Explore newer commands available only in newer versions of MARS code • Configure MARS to authenticate to a Cisco Secure ACS using RADIUS Why Take MARS from Global Knowledge? We’ve enhanced our labs well beyond what you’ll find in the standard Cisco MARS training course, and we incorporate more real-world labs, network devices, and software applications. The standard Cisco MARS course uses preconfigured virtual devices where we use real equipment to prepare you for real-world scenarios. You’ll benefit from the expertise of our skilled instructors, who have experience deploying this appliance in the field going back to the days when this was a Perfigo™ appliance. With our approach to MARS training, you’ll gain confidence in your familiarity with the MARS appliance as well as its integration with most Cisco equipment, Windows Servers, and other common software applications. Our enhanced labs provide access to the latest MARS software, while the standard course is based on the older 4.3.1 code. Also, our course includes a lab on configuring Cisco Security Manager (CSM) with a Cisco IPS and performing an attack scenario to cross-launch the incident from MARS to CSM. What You’ll Learn in Class • MARS design solutions, features, and functions as they relate to security incidents and security information in an enterprise network • Basic physical installation process • Add Cisco and non-Cisco security and network devices into the MARS appliance • Configure network devices to generate events that constitute an attack scenario and have MARS collect the events for incident investigation • Attack mitigation and false positive confirmation • Perform Incident Investigation and Mitigation • Create, view, and save a long-duration query and reports • Configure the MARS appliance to send alerts • Configure rules that detect interesting patterns of network activity • Use Case Management features in the MARS appliance to assign incidents to specific MARS users for follow up • Configure hardware maintenance chores • MARS Global Controller and Log Parser Templates • Distributed Threat Mitigation using the Cisco IOS IPS • Configure antivirus software to report a live virus • MARS Interaction with Cisco Security Manager • Basic configuration of a Cisco IPS in Cisco Security Manager • Configure various Windows Servers (2003 and 2000) to use SNARE and RPC to report log events to MARS Classroom Learning 4 days $2,895 29 CLCs On-Site Learning Call for info. Classroom Learning CA Los Angeles CA Sacramento CA San Jose DC Washington DC Washington FL Orlando GA Atlanta Jun 23-26 May 19-22 Mar 17-20 Mar 10-13 Jun 9-12 Jan 6-9 Dec 9-12 GA Atlanta GA Atlanta IL Chicago IL Chicago MA Boston NC Raleigh NC Raleigh NJ Morristown Feb 10-13 May 26-29 Mar 31-Apr 3 Jun 29-Jul 2 Feb 24-27 Jan 27-30 Jun 2-5 Apr 14-17 NY NY OH ON ON TX TX TX New York New York Columbus Toronto Toronto Dallas Dallas Houston Jan 20-23 Apr 21-24 Jun 16-19 Jan 12-14 Apr 20-23 Feb 3-6 May 5-8 Jan 13-16 50 REGISTER NOW 1-800-COURSES www.globalknowledge.com/cisco http://www.globalknowledge.com/cisco
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.