Ever run into a product that MARS doesn’t support but you wished it did? Have you ever created your own custom parser to support a product that MARS didn’t have natively? If you answered yes to either of those questions then this blog will be right up your alley. Way back in February 2009 Cisco launched a MARS community forum to hasten the sharing of custom parsers, rules, and report templates among its sizeable MARS customer base. The MARS forum is located on Cisco’s NetPro site. So, if you run into an unsupported product that you need to report in to Cisco MARS then check the forum, it just might be there for you. Furthermore, if you have developed your own custom parser for an unsupported product then upload it to the forum to share with the MARS community.
You will need to be at 6.0.1 or later code in order to participate in the MARS package sharing forum. The Device Support Framework feature in 6.0.1 or later enables the definition, export, and import of packages that describe a new device type. Specifically, it defines the device type, event parsing rules, inspection rules, and reports. You can export and reuse these “packages” across multiple Local Controllers and Global Controllers or with other companies.
The MARS package sharing forum is currently pretty sparse. Mostly due to lack of marketing I think, nobody knows about it. Hopefully this blog will spur more MARS owners to take a minute and upload/share your packages with each other. Here is how to export a package from Cisco MARS:
1) Click on the Admin tab
2) Click on the Custom Setup tab and then click the Device Support Packages link
3) The Device Support Packages page is where you can export or import MARS packages. Just click on the appropriate button.
4) When you click on export or import it will run you through a wizard. Just follow the steps.
For more information on how to use the Device Support Framework see here.
To subscribe to the Cisco MARS forum’s RSS feed click here.
Also part of the forum is a discussion list that is fairly active and monitored by the Cisco MARS Business Unit. This is a great place to get your questions answered. See it here.
So, did you already know about the MARS forum? If not, will you start to share your packages with the MARS community?
The opinions and information presented here are my PERSONAL views and not those of my employer. I am in no way an official spokesperson for my employer.
More from Jamey Heary:
* Credit Card Skimming: How thieves can steal your card info without you knowing it
* Cisco enters the crowded AV and DLP client market
*Cisco's new ASA code allows you to securely take your Cisco IP Phone with you anywhere
* Cisco targets Symantec, McAfee with its new antivirus client
* Google's Chrome raises security concerns and tastes like chicken feet a>Go to Jamey’s Blog for more articles on security.
Jamey Heary, CCIE No. 7680, is the author of the Cisco NAC Appliance: Enforcing Host Security with Clean Access book by Cisco Press. Jamey is a seasoned security technologist with over 15 years in the IT field with 10 years focused on IT security. His areas of expertise include network and host security design and implementation, security regulatory compliance, and routing and switching. His other certifications include CISSP, CCSP, and Microsoft MCSE. He is also a Certified HIPAA Security Professional. Jamey is currently a Security Consulting Systems Engineer with Cisco, though the opinions expressed here are his own. Jamey is a member of Network World's Cisco Subnet blog community.
The Leader in Network Knowledge
Post new comment