IPS 6.0 Security Monitor

Question

Will the 6.0 sensors work with SecMon? And please don't tell me I will be forced to use CS MARS. So will there be an update to SecMon to allow it to work with 6.0?

Answer 1

I will outline several critical needs for any device that will serve as a centralized log analysis vehicle for the IPS/IDS's.
SecMon
1)Real-Time event Alerting - Yes
2)Drill down option - Yes
3)Instant View to Host, Dest, Content - Yes
4)Ability to Handle Custom Sig - Yes
5)Ability to Handle New Sig Release - Yes
CS-MARS
1)Real-Time event Alerting - Nope *Time Interval Incident reporting*
2)Drill down option - Some, but you have to constantly run queries to focus in on your investigation.
3)Instant View to Host, Dest, Content - Nope
4)Ability to Handle Custom Sig - Never!!!, You can make rules to alert on the events, but you cannot add new Security Events to Mars. Yeah that was smart.
5)Ability to Handle New Sig Release - Unless you're happy with seeing that a majority of the events on the MARS box as ***Unknown Security Event*** then by all mean go spend the money on MARS. PS, they never mention this when they sell it to you. Oh yeah and netflow, ask them to actually display netflow logs :-) unless this has been fixed already.
As for Netforensics, I'm not interested in spending even more on a box that does pretty much what Event Viewer does but for more than 5 appliances at once!
Look, I want to use SecMon, I just whish that Cisco extended a hand to the people who use their product for input, I would love to participate in a way that we the end users can have a product that does what we need the most. Now, sadly SecMon which is part of the horrid VMS setup is now going away, seriously I hope Cisco reconsider their decision about SecMon, if anything include a SecMon Functionality in MARS!
So in conclusion, please Cisco, please do not let SecMon disappear.
I hope that fellow users speak up too, Keep SecMon or some form of it!!!