Cisco Cisco Security Monitoring, Analysis and Response System 3.3 Guide D’Information
All contents are Copyright © 1992–2006 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information.
Page 8 of 8
Q.
What rules can I see at the Local Controller?
A.
The built-in rules shipped with the system are global and are defined both in the Local Controllers and the Global Controller.
●
Rules created on the Global Controller are known as “global rules”
●
Global rules are pushed down to all Local Controllers (with the exception of system rules)
●
Changes made to system rules on the Global Controller are pushed down to Local Controllers
●
Identical rules created on the Global Controller and Local Controller can be determined by their naming convention
●
Global user-inspected rules are named as “Global Rule -<name>“ on the Local Controller
●
Global rules are automatically pushed down to a newly added Local Controller
●
Global rules cannot be deleted but the state can be changed to “inactive” on both the Global Controller and the Local Controller
Q.
Can I scale running reports at the Global Controller?
A.
You can create batch queries and reports for selected zones, which are then pushed down to the Local Controllers. Global batch query
and report results from each selected Local Controller are pushed up to the Global Controller. On the Global Controller, you can view
reports based on:
●
Aggregated results from all the Local Controller filters by total, peak, or recent activity
●
The sum of all Local Controllers, list zones, or one specific zone
Printed in USA
C67-60016-02 03/07