| This chapter covers the following subjects: CiscoWorks 2000 Security Monitor Installing Security Monitor Security Monitor Configuration Security Monitor Event Viewer Security Monitor Administration Security Monitor Reports
When deploying a large number of Cisco IPS sensors, you need an efficient way to monitor the alerts from these devices. Security Monitor (a component of the CiscoWorks VPN/Security Management Solution [VMS] product) provides this functionality. Using Security Monitor, you can correlate and analyze events from multiple sensors deployed throughout your network through a graphical interface. Configuring Security Monitor correctly is crucial to efficiently identifying intrusive activity on your network. "Do I Know This Already?" Quiz The purpose of the "Do I Know This Already?" quiz is to help you decide if you really need to read the entire chapter. If you already intend to read the entire chapter, you do not necessarily need to answer these questions now. The 10-question quiz, derived from the major sections in the "Foundation and Supplemental Topics" portion of the chapter, helps you determine how to spend your limited study time. Table 10-1 outlines the major topics discussed in this chapter and the "Do I Know This Already?" quiz questions that correspond to those topics. Table 10-1. "Do I Know This Already?" Foundation and Supplemental Topics MappingFoundation or Supplemental Topic | Questions Covering This Topic |
|---|
CiscoWorks 2000 | - | Security Monitor | - | Installing Security Monitor | 1, 2, 3 | Security Monitor Configuration | 4, 5, 6 | Security Monitor Event Viewer | 7, 8 | Security Monitor Administration | 10 | Security Monitor Reports | 9 |
Caution The goal of self-assessment is to gauge your mastery of the topics in this chapter. If you do not know the answer to a question or are only partially sure of the answer, you should mark this question wrong for purposes of the self-assessment. Giving yourself credit for an answer you correctly guess skews your self-assessment results and might provide you with a false sense of security.
| 1. | What is the minimum recommended amount of RAM for the Security Monitor server? 2 GB 1 GB 512 MB 256 MB 1.5 GB
| | 2. | What is the minimum recommended amount of RAM for the client systems that access Security Monitor? 2 GB 1 GB 512 MB 256 MB 1.5 GB
| | 3. | What part of the Security Monitor interface provides a visual road map indicating where you are? Path bar Options bar Instruction box Content area Road map
| | 4. | When you add a monitored device to Security Monitor, which of the following devices does not allow you to specify the protocol that the device uses to communicate with Security Monitor? RDEP device PostOffice device IPS 5.0 sensor PIX Firewall IDS 4.0 sensor
| | 5. | Which of the following is not a characteristic that you can specify when configuring an event rule? Originating device Signature name Attacker port Severity Victim address
| | 6. | Which of the following is not a category whose statistics you can view using Security Monitor? Network Access Controller Analysis Server Transaction Server Event Server Analysis Engine
| | 7. | Which of the following items is not configurable when you change the Event Viewer display preferences? Columns displayed Event severity indicator type Default expansion boundary Time for Security Monitor-initiated blocks Maximum events per grid
| | 8. | Which color is the background of the count field for medium-severity events? Red Orange Yellow Green White
| | 9. | Which of the following is not a parameter that you can configure when customizing a report template? Source IP address Destination direction IDS devices IDS signatures Risk Rating
| | 10. | Which of the following is not a parameter that you can configure when defining a database rule? Total IDS events in database exceed Total audit log events in database exceed Total PIX events in database exceed Database free space less than (megabytes) Repeat every
|
The answers to the "Do I Know This Already?" quiz are found in the appendix. The suggested choices for your next step are as follows: 8 or less overall score Read the entire chapter. This includes the "Foundation and Supplemental Topics" and "Foundation Summary" sections and the Q&A section. 9 or 10 overall score If you want more review on these topics, skip to the "Foundation Summary" section and then go to the Q&A section. Otherwise, move to the next chapter.
| 