Getting Started - IV

Integrating devices with MARS - Continued

The third method of integrating devices i.e. Importing the list of devices using a seed file.

What is a Seed file?
Its an spreadsheet file which contains the details of the devices such as hostname, Reporting and Access IP, Access Types, Login names and Passwords, enable password etc. So, whatever details required to add a device manually has to be entered in this sheet collectively for all the devices.

The instructions to create the seed file is available in the following link.
http://docs.google.com/View?id=drd8342_1hffc8pfs

This file has to be saved as a .csv file and to be uploaded to a FTP server where MARS can access. Go to Admin->System Setup->Security and Monitoring Devices and select the option Load from Seed File.

This action will take you to a page where the details to access the seed file has to be provided. The IP address of the file share server. The login to fetch the file and the path of the file. Submit the window with details. Once it verifies the data provided, MARS will start discovering the devices listed in the file and will add to it. It can be verified in the Security and Monitoring Devices page.



Things to be noted

1. The flow of column mentioned in the link above should be followed exactly. It should not be changed and the values to those fields should be mentioned correctly. If the column is labeled as 'Empty' no value should be filled in that.


2. If the provided device details in the seed file is wrong, that particular device will not be added to MARS.
   


3. If the provided details such as Access types, enable password, Login is wrong in the file, then MARS will discover that particular device with the provided SNMP RO. This can be verified by editing the device in the Security and Monitoring Devices page. Later, the correct login credentials can be provided and discovered again.
   


4. This importing process will not tell you the exact count of device added. We have to check this manually in to the list.


5. While providing the details of the file in the Load from Seed file option, the exact path has to be mentioned such that MARS can reach and fetch the file.

So these points will make you to execute this process in a systematic way.

And this is how we Integrate devices with MARS in three methods. The added devices can be seen through a map in the Summary tab. It will show you the topology graph of all the devices added.

If you come across any queries regarding the Seed file importing you can write to me. And the next post will contain the flow of traffic and reading the events from devices.

Keep reading and keep suggesting to enhance this blog.

Getting Started - III

Integrating devices with MARS - Continued

The second method of integrating devices to MARS ie Manual integration of devices can be done as follows.
Make a list of devices which has to be added with the details such as hostname, IP address, SNMP community, Login, password and enable password in case of any Cisco Hardware devices.


Go to Admin->System Setup->Security and Monitoring Devices and click the Add option. This will take you to the page which will ask you the information about the device.

Device type drop down box will contain a list of natively supported hardware and software devices. I will explain in detail about the steps to add a hardware device and a software device with an example.


To add a hardware device such as ASA firewall for example, follow the procedure.
Select the device type from the column relevant to ASA with version.

Access IP : It is the IP address through which MARS can access the device. So, provide the IP address of the ASA firewall so that MARS can access it.

Reporting IP : It is the IP address by which MARS receives the events. ie. The IP by which ASA reports MARS.

Access Type : It is the option by which MARS access the ASA firewall.

Other option such as Login, Password, Enable Password, SNMP RO community can be provided such that MARS can access ASA.



Click the Discover option after providing all the details. If the provided details are right and if MARS can access ASA, the discovery will be successful and the device will be added to MARS.

Else there will be an option to view the error. Click the View Error option if you get any errors while discovering.

After successful integration, it can be verified by checking the list of devices available in the Security and Monitoring Devices Column in the Admin tab.

Lets take a Software device integration. For example, I will add a Windows 2003 Server and the Oracle Application present in it.

Go to Security and Monitoring Devices->Add. Select the Add SW security apps on new host option from the Device Type column.
Provide the details of the server. Here, Operating System column will be used to mention the kind of OS in that host. Clicking the Logging Info button will prompt you for the type of Windows Server and the choice of selecting the logging method. Better select the Receive option.

Apply the settings and then click Next. This action will take you to the Reporting Applications tab. Select the Oracle application which is relevant to the server. Click Add option next to it after selecting the application. It will take you to the Oracle server settings page. The oracle login credentials and service should be provided there. Test Connectivity and Submit.



By submitting the settings, the Oracle application will be added to that Reporting Application tab. Any other application can also be added in the same way. The added application can be viewed in the same tab. The settings can be modified anytime.


If you are Done with the settings the host will be added to MARS. It can be viewed in the list of monitoring devices. If you find a red coloured button at the top right column by named Activate, click that to activate all the changes made.





So, this is how you add the supported devices to MARS individually.

You may may some queries at this point of time.

Why is the Login, password and enable password required while adding hardware devices?

Mars can use this login credentials to access the device and understand the configurations of the firewall. It may use those configurations and it recommends some corrective action to be made at the time of any threat detections.

While providing the Logging method in adding a Server we select the Receive. How will Windows log events?

Windows cannot send any logs directly to MARS. There is a agent software called Snare, this software will forward the event viewer logs to MARS. Snare is recommended by Cisco Systems.


The next post will contain the third method of adding the devices.

Is this blog useful ? Your suggestions and comments are welcome.