Appendix B. Security Monitor Integration

The CiscoWorks VPN/Security Management Solution (VMS) package consists of several components. The majority of the components, known as management centers (MC), are used for configuring and updating specific types of devices. The CSA MC is used to manage a Cisco Security Agent (CSA) deployment, the Firewall MC is for managing the Cisco PIX Firewall family, and the IDS MC is used to manage Cisco IDS sensors.

You can install another component as part of a VMS server deployment that all the Cisco security components can use. This package is the Monitoring Center for Security, also known as the Security Monitor.

The Monitoring Center for Security is a software package that is capable of receiving alert/events from various Cisco security devices, including network Intrusion Detection/Protection Systems (IDS/IPS), Host IPSs, and syslogs from PIX Firewalls. Receiving the alerts in a single monitoring application allows for centralized viewing of correlated events. This package can then send notification of an issue or provide reporting capabilities on the aggregate data. Because it is a component of the VMS package and is licensed as part of the VMS software, it can also use the inherent role-based access control capabilities that the suite of utilities implements. Therefore, administrative users can have varying levels of control over the monitoring package based on their user rights granted by the overall VMS system itself.

You will find the Security Monitor to be a useful package when attempting to correlate events across your network. This appendix does not cover the Security Monitor in detail because the goal is only to help you understand what the Security Monitor is capable of providing a CSA deployment and what is necessary to get the two components to communicate.