Have you planned your                                         replacement for Cisco MARS?© 2013, SolarWinds Worldwide, LLC...
Agenda1. Why should you find a replacement now?2. What to look for in a replacement tool?3. Why SolarWinds could be the ri...
Why should find a replacement now?»       What’s up with Cisco MARS?       Cisco has decided it is right time for        ...
What to look for in a replacement tool?»      Best-in-class SIEM technology provides:       All-in-one affordable log and...
Why SolarWinds could be your alternativeLet us consider the top 6 decisive factors:   1. Deployment   2. Event-Correlation...
Deployment» Cisco MARS                                 » SolarWinds LEM    It is a hardware appliance which           It...
Event Correlation» Cisco MARS                                   » SolarWinds LEM       It comes with the complexity of   ...
Event Correlation (Contd…)»       SolarWinds LEM can:       Correlate time-based and transaction-        based events    ...
Power of Search» Cisco MARS                                          » SolarWinds LEM       The scope of search in MARS i...
Power of Search (Contd…)»      Not just search, LEM allows you to       store log data in a centralized       repository.»...
Compliance Reporting»     LEM comes with 300+ "audit-      proven" compliance reports to      comply with so many federal ...
Incident Response»     With a library of built-in Active Responses LEM      executes the automated responses needed to    ...
Device Support»       MARS is focused on Cisco networking devices»       SolarWinds LEM extends support to network devices...
Test Drive an Alternative for MARS»       SolarWinds’ best-in-class SIEM technology provides all-in-one affordable        ...
Additional Security Recommendations»      Some other key areas that you may need to equip yourself are:           Firewal...
Thank You!CISCO MARS REPLACEMENT- SOLARWINDS LEM                                         16
Upcoming SlideShare
Loading in …5
×

What is your alternative to Cisco MARS?

2,067 views

Published on

Cisco is no longer offering Cisco Security Monitoring, Analysis and Response System (MARS). Have you found an alternative solution? In this slideshare, we will showcase how SolarWinds Log & Event Manager might be the right choice for you.

Published in: Technology
0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
2,067
On SlideShare
0
From Embeds
0
Number of Embeds
2
Actions
Shares
0
Downloads
0
Comments
0
Likes
1
Embeds 0
No embeds

No notes for slide

What is your alternative to Cisco MARS?

  1. 1. Have you planned your replacement for Cisco MARS?© 2013, SolarWinds Worldwide, LLC. All rights reserved. 1
  2. 2. Agenda1. Why should you find a replacement now?2. What to look for in a replacement tool?3. Why SolarWinds could be the right alternative a. Deployment b. Event Correlation c. Power of Search d. Compliance Reporting e. Incident Response f. Device Support4. Additional Security RecommendationsCISCO MARS REPLACEMENT- SOLARWINDS LEM 2
  3. 3. Why should find a replacement now?» What’s up with Cisco MARS?  Cisco has decided it is right time for the hardware to not be sold in the market and it has been scrapped for new purchases Do you have a plan B?  Cisco no longer sells Cisco Security We have one for you… Monitoring, Analysis and Response Check how SolarWinds Log and System (MARS) Event Manager (LEM) can help?  Read the End-of-Life Notice to learn more CISCO MARS REPLACEMENT- SOLARWINDS LEM 3
  4. 4. What to look for in a replacement tool?» Best-in-class SIEM technology provides:  All-in-one affordable log and event analysis  Active responses to react to real-time threats while complying with regulatory policies» Also a SIEM tool that has in-memory analytics that can capture, correlate and respond to network attacks and insider abuse at network speed.CISCO MARS REPLACEMENT- SOLARWINDS LEM 4
  5. 5. Why SolarWinds could be your alternativeLet us consider the top 6 decisive factors: 1. Deployment 2. Event-Correlation functionality 3. Power of Search 4. Compliance Reporting 5. Incident Response 6. Device Support» See how SolarWinds Log and Event Manager (LEM) compares to Cisco MARS on all the above parameters.CISCO MARS REPLACEMENT- SOLARWINDS LEM 5
  6. 6. Deployment» Cisco MARS » SolarWinds LEM  It is a hardware appliance which  Its a virtual appliance which requires physical setup and downloads and deploys in just network connections to become under an hour. fully operational.  It is not a standalone solution,  LEM is all equipped own its but part of Cisco Security own and needs no supporting Management Suite which needs and add-on devices or modules the support of Cisco Security to deliver its full service. Manager (CSM) to deliver the full extent of service.CISCO MARS REPLACEMENT- SOLARWINDS LEM 6
  7. 7. Event Correlation» Cisco MARS » SolarWinds LEM  It comes with the complexity of  As a standalone product, uses defining and building its multi-dimensional correlation rules to handle correlation engine to detect multiple device and multiple behavioral anomalies in real- events time.  Relies on Cisco CSM to perform  It also employs a simple and event correlation easy-to-use rule builder with familiar drag and drop interface, icon-based tool panel and graphical object selection panel. LEM also comes with 700+ pre-built correlation rules that cover critical network infrastructure, change management and network security functions.CISCO MARS REPLACEMENT- SOLARWINDS LEM 7
  8. 8. Event Correlation (Contd…)» SolarWinds LEM can:  Correlate time-based and transaction- based events  Send notifications and trigger actions based on event correlation that happens in-memory  Perform multiple event correlation  Ability to set independent thresholds for activity per event, or group of events  Leverage non-linear event correlation  Access to field-level data for event LEM’s Correlation Rule Builder Interface with Simple Drag & Drop Options correlation rules  Create user-defined groups and variables for event correlation rulesCISCO MARS REPLACEMENT- SOLARWINDS LEM 8
  9. 9. Power of Search» Cisco MARS » SolarWinds LEM  The scope of search in MARS is  LEM is equipped with a powerful basic and limited and intuitive search option with which you can explore search log  The method of search is not data visually. very simple  It also allows you to use search tools like Word Clouds, Tree- maps, Bubble Charts and Histograms. Notable here is the Word Clouds - the first implementation ever in a log monitoring system.CISCO MARS REPLACEMENT- SOLARWINDS LEM 9
  10. 10. Power of Search (Contd…)» Not just search, LEM allows you to store log data in a centralized repository.» Compares original log data and normalized event data side-by-side and easily found with LEM’s various search options.» Eliminates the need for additional hardware with a high compression data model that stores data at up to a 60:1 compression ratio. LEM’s Advanced & Intuitive IT Search Options CISCO MARS REPLACEMENT- SOLARWINDS LEM 10
  11. 11. Compliance Reporting» LEM comes with 300+ "audit- proven" compliance reports to comply with so many federal policies like PCI DSS, GLBA, SOX, NERC CIP, HIPAA and even more.» You can run these policies through LEM to get graphical report summaries from the extensive resource of log data that were captured in real-time.» Cisco MARS is not equipped with Select Your Choice of Regulatory Compliance Policies and Run Reports Using LEM such a store of compliance reports CISCO MARS REPLACEMENT- SOLARWINDS LEM 11
  12. 12. Incident Response» With a library of built-in Active Responses LEM executes the automated responses needed to mitigate threats and respond to operational issues, security breaches, malware and policy violations immediately.» LEM doesn’t need any integration with any Incident Response system.» Whereas Cisco MARS which requires integration with Cisco Intrusion Prevention System (IPS) to respond and take action on LEM’s Active Response Technology in Action real-time security threats. Some of LEM’s Active Responses include quarantining infected machines, blocking IP addresses, disabling user accounts, killing unauthorized processes and restarting services. CISCO MARS REPLACEMENT- SOLARWINDS LEM 12
  13. 13. Device Support» MARS is focused on Cisco networking devices» SolarWinds LEM extends support to network devices from dozens of manufacturers, hundreds of products, and thousands of models and various operating systems and applications. Supports Multiple DevicesCISCO MARS REPLACEMENT- SOLARWINDS LEM 13
  14. 14. Test Drive an Alternative for MARS» SolarWinds’ best-in-class SIEM technology provides all-in-one affordable log and event analysis and management software that also performs active responses to react to real-time threats while complying with regulatory policies. Try out the fully-functional 30-day free trial to see LEM in action.CISCO MARS REPLACEMENT- SOLARWINDS LEM 14
  15. 15. Additional Security Recommendations» Some other key areas that you may need to equip yourself are:  Firewall Security Management  Network Change & Configuration Management  Endpoint Vulnerability Management  Endpoint Data Loss Preventions» You can read more from this whitepaper The Case for Security Information and Event Management (SIEM) in Proactive Network Defense CISCO MARS REPLACEMENT- SOLARWINDS LEM 15
  16. 16. Thank You!CISCO MARS REPLACEMENT- SOLARWINDS LEM 16

×