If a device is monitored by multiple CS-MARS appliances, how can I choose the CS-MARS appliance for which I want to view the events after lookup?
A. If more than one CS-MARS monitors a device added to Security Manager, the Select CS-MARS dialog box appears, prompting you to select the CS-MARS device that you want to associate with the device or use to view events for the selected policy rule. This dialog box appears when you try to discover the CS-MARS device for a device from the Device Properties page or when you lookup events for a device monitored by multiple CS-MARS devices, whichever operation is performed first. Once a CS-MARS device is resolved to a device, you are not prompted to select from a list of available choices.
Related Questions
- Is there any limit to the number of keywords that are populated in the Query page of CS-MARS when I perform events lookup from an access rule that supports hashcodes?
- If a device is monitored by multiple CS-MARS appliances, how can I choose the CS-MARS appliance for which I want to view the events after lookup?
- What are the versions of CS-MARS and Security Manager that are supported for events lookup from policies?
