Security Threat Mitigation and Response: Understanding Cisco Security MARS

Chapter 4. CS-MARS Technologies and Theory

<feature><title></title>

This chapter introduces you to the CS-MARS hardware appliances and shows you how CS-MARS operates and processes its information. Topics in this chapter include the following:

• Technical Introduction to the CS-MARS Appliance

• Database Storage and Utilization

• Network Topology Used for Forensic Analysis

• NetFlow in CS-MARS

• Positive Alert Verification and Dynamic Vulnerability Scanning

• Methodology of Communication

</feature>

In this chapter, you are introduced to the CS-MARS appliance and discover what it is really about. Part I, “The Security Threat Identification and Response Challenge,” introduced you to the SIM and STM industry and covered why networks need to become proactive security ...