Cisco IPS Management Software
You can use the command-line interface (CLI) to configure an IPS solution, but it is simpler to use a graphical user interface (GUI)-based device manager. The following describes the Cisco device management software available to help you manage an IPS solution.
Cisco Router and Security Device Manager
Cisco Security Device Manager (SDM), shown in Figure 6-2, is a web-based device management tool for Cisco routers that can improve the productivity of network managers, simplify router deployments, and help troubleshoot complex network and virtual private network (VPN) connectivity issues. Cisco SDM supports a wide range of Cisco IOS Software releases and is available free on Cisco router models from the Cisco 850 Series Integrated Services Router to the Cisco 7301 Router.
)
Figure 6-2 Cisco Router and Security Device Manager
Cisco Security Monitoring, Analysis, and Response System
Cisco Security Monitoring, Analysis, and Response System (MARS), shown in Figure 6-3, is an appliance-based, all-inclusive solution that enables network and security administrators to monitor, identify, isolate, and counter security threats. This family of high-performance appliances enables organizations to more effectively use their network and security resources.
)
Figure 6-3 Cisco Security Monitoring, Analysis, and Response System
Cisco Security MARS can monitor security events and information from a wide variety of sources, including third-party devices and hosts. With its correlation engine, vector analysis, and hotspot identification, Cisco Security MARS can identify anomalous behavior and security threats, and recommend precision removal of those elements, which leads to rapid threat mitigation. In addition, Cisco Security MARS incorporates a comprehensive reporting engine that provides easy access to information for compliance reporting.
Cisco IDS Event Viewer
Cisco IDS Event Viewer (IEV), referred to also as Cisco IPS Event Viewer, is a Java-based application that enables you to view and manage alarms for up to five sensors. With Cisco IEV, you can connect to and view alarms in real time or in imported log files. You can configure filters and views to help you manage the alarms. You can also import and export event data for further analysis.
Cisco IEV offers a no-cost monitoring solution for small-scale IPS deployments. Monitoring up to five individual IPS devices, Cisco IEV is easy to set up and use, and provides the user with the following:
- Support for Cisco IPS Sensor Software Version 5.x through Security Device Event Exchange (SDEE) compatibility
- Customizable reporting
- Visibility into applied response actions and threat rating
Cisco Security Manager
Cisco Security Manager is a powerful, but very easy-to-use solution, to centrally provision all aspects of device configurations and security policies for Cisco firewalls, VPNs, and IPS. The solution is effective for managing even small networks that consist of fewer than 10 devices, but also scales to efficiently manage large-scale networks that are composed of thousands of devices. Scalability is achieved through intelligent policy-based management techniques that can simplify administration.
Features of CSM include the following:
- Auto update for Cisco IOS Release 12.4(11)T2 or later
- Custom signature templates
- Signature wizards to create and update signatures
Cisco IPS Device Manager
Cisco IPS Device Manager (IDM) is a web-based configuration tool for network IPS appliances. It is shipped at no additional cost with the Cisco IPS Sensor Software. Cisco IDM implements a web-based GUI.
NOTE
In May 2008, Cisco announced the release of a new product called Cisco IPS Manager Express. The new Cisco IPS Manager Express (IME), shown in Figure 6-4, is a powerful yet easy-to-use all-in-one IPS management application for up to five IPS sensors. Cisco IME can be used to provision, monitor, troubleshoot, and provide reports for IPS 4200 series sensors, ASA 5500 IPS solution, AIM-IPS on ISRs, and IDSM2 on Catalyst 6500s. To have access to all the capabilities of Cisco IME, it has to be used with sensors running Cisco IPS Software 6.1. With IPS Software Versions 5.1 or 6.0, or IOS IPS, you can use IME to monitor and provide reports only, with limited dashboard support.
)
Figure 6-4 Cisco IPS Manager Express
Some of the features of Cisco IPS Manager Express are a customizable dashboard, powerful monitoring with real-time and historical viewing, integrated policy provisioning with risk rating, a flexible reporting tool, RSS feed integration, email notification, 75 events per second, and up to five IPS sensors.