| In addition to the basic IDS sensors in IOS and PIX software, Cisco also provides an extensive range of IDS products to suit most environments. Some of these products are as follows: Cisco IDS 4200 Series Sensors Signature-based NIDS appliances. IDS Network Module for Routers Signature-based NIDS module for space-saving and cost-effective intrusion detection using 2600, 3600, and 3700 Series routers. IDS Services Module switches Signature-based IDS for Catalyst 6500 switches. Cisco Secure Agent (CSA) Anomaly-based HIDS for Windows and Solaris hosts. CiscoWorks RME Although not an IDS product, RME manages and audits the configuration of network devices. RME also sends alerts through e-mail/pagers regarding changes in configuration.
In addition to a range of IDS products, Cisco also offers various tools for centrally managing these products. Moreover, the amount of logs and alerts collected by a central logging device can be overwhelming. Cisco also offers products to efficiently manage and correlate the alerts and logs. Some of these products are as follows: Cisco Threat Response Eliminates false alarms, quickly identifies real intrusions, and automates investigations and forensic data captures. Cisco Security Monitoring, Analysis and Response System (CS-MARS) An appliance that collects and correlates logs and events from various network devices, including IDSs, firewalls, and routers. It provides a visual topology map of a network attack and allows the Netadmin to limit or prevent an attack in real time. CiscoWorks Security Information Management Solution Collects, analyzes, and correlates security event data from across the enterprise using netForensics. CiscoWorks VPN/Security Management Solution Web-based tools for configuring, monitoring, and troubleshooting network-intrusion- and host-intrusion-prevention systems (CSAs), VPNs, and firewalls; integrated with other CiscoWorks products; provides network device inventory, change audits, and software distribution features.
|
