Re:

[John Rasmussen <rasmusse () OHSU EDU>]

We also use the Cisco MARS for data collection from our FWSM and other data sources.
 
We are in the process of installing the Juniper IDP which is a very robust tool that integrates well into the MARS.
 
John

> > > pennb () UWW EDU 7/20/2006 7:16:13 AM >>>

We use MARS and it's not really an IPS - it's more of an EM/SEM.  That being
said, we plan to log all of our snort, StealthWatch and Cisco ASA and FWSM
alerts to the device which will hopefully give us a more comprehensive view
of intrusion attempts (and all other security events) than an IPS itself.
We found MARS to be very useful in our pilot and expect it will do the same
in early production.   

__
Blake

-----Original Message-----
From: John Kaftan [mailto:jkaftan () HOTMAIL COM] 
Sent: Thursday, July 20, 2006 8:30 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY]

We are looking into Intrusion Prevention Systems.  We have looked at
Tipping-Point are about to look at Cisco MARS.  Does anyone have any
experiences that they care to share?

John Kaftan

_________________________________________________________________
Is your PC infected? Get a FREE online computer virus scan from McAfeeR
Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963