Login
Login

Cisco Security Agent

{{Use dmy dates|date=October 2023}}

{{multiple issues|{{Notability|Products|date=March 2012}}

{{more citations needed|date=October 2022}}

{{advert|date=March 2012}}

{{inline citations|date=July 2024}}}}

{{Infobox software

| logo =

| screenshot =

| caption =

| name = Cisco Security Agent

| developer = Okena/Cisco

| latest release version = 6.0.2.130

| latest release date = {{start date and age|2010|6|7|df=yes}}

| operating system = Cross-platform

| genre = Security / IPS

| license = Per-computer, through Cisco

| website = [http://www.cisco.com/en/US/products/sw/secursw/ps5057/index.html Cisco Security Agent]

}}

Cisco Security Agent (CSA) was an endpoint intrusion prevention system software made originally by Okena (formerly named StormWatch Agent), which was bought by Cisco Systems in 2003.{{Cite web |title=Cisco Security Agent |url=https://www.oit.va.gov/Services/TRM/ToolPage.aspx?tid=13529 |access-date=2022-09-23 |website=oit.va.gov}}

The software is rule-based and it examines system activities and network traffic, determining which behaviors are normal and which may indicate an attack. CSA was offered as a replacement for Cisco IDS Host Sensor, which was announced end-of-life on 21 February 2003. This end-of-life action resulted from Cisco's acquisition of Okena, Inc., and the Cisco Security Agent product line based on the Okena technology would replace the Cisco IDS Host Sensor product line from Entercept.

As a result of this end-of-life action, Cisco offered a no-cost, one-for-one product replacement/migration program for all Cisco IDS Host Sensor customers to the new Cisco Security Agent product line. The intent of this program was to support existing IDS Host Sensor customers who chose to migrate to the new Cisco Security Agent product line.

All Cisco IDS Host Sensor customers were eligible for this migration program, whether or not the customer had purchased a Cisco Software Application Support (SAS) service contract for their Cisco IDS Host Sensor products.

CSA uses a two or three-tier client-server architecture. The Management Center (MC) (Management Console) contains the program logic. An MS SQL database backend is used to store alerts and configuration information. The MC and SQL database may be co-resident on the same system.

The agent is installed on the desktops and/or servers to be protected and communicates with the Management Center, sending logged events to the Management Center and receiving updates on rules when they occur.

A Network World article dated 17 December 2009 stated, "Cisco hinted that it will end-of-life both CSA and MARS"—full article linked below.

On 11 June 2010, Cisco announced the end-of-life and end-of-sale of CSA. Cisco did not offer any replacement products.

See also

Related certifications

Although Cisco Security Agent (CSA) reached end‑of‑sale in 2010, several current Cisco certifications now cover the host‑based intrusion‑prevention concepts that CSA pioneered:

  • Cisco Certified CyberOps Associate (exam CBROPS 200‑201) – introduces endpoint threat analysis, host‑based controls and incident‑response fundamentals.{{cite web |title=CBROPS 200‑201 Exam Topics |url=https://learningnetwork.cisco.com/s/cbrops-200-201 |publisher=Cisco Systems |access-date=24 April 2025}}
  • Cisco Certified CyberOps Professional (core exam CBRCOR 350‑201 plus concentration) – expands on advanced endpoint forensics and extended detection and response (XDR) workflows.{{cite web |title=CBRCOR 350‑201 Exam Topics |url=https://learningnetwork.cisco.com/s/cbrcor-350-201 |publisher=Cisco Systems |access-date=24 April 2025}}
  • Cisco Secure Endpoint Specialist – product‑focused training on Cisco Secure Endpoint (formerly AMP for Endpoints), the direct successor to CSA.{{cite web |title=Cisco Secure Endpoint Specialist Certification |url=https://www.cisco.com/go/secure-endpoint-cert |publisher=Cisco Systems |access-date=24 April 2025}}
  • CCNP Security – Securing Networks with Cisco Firepower (exam 300‑710 SNCF) – covers correlation of host‑intrusion telemetry within Firepower Management Center.{{cite web |title=300‑710 SNCF Exam Topics |url=https://learningnetwork.cisco.com/s/sncf-300-710 |publisher=Cisco Systems |access-date=24 April 2025}}

These credentials provide a contemporary learning path for professionals interested in the capabilities once delivered by CSA.

References

External links

  • [http://www.matrixgp.com/Files/StormShield/CSA%20Surviving%20the%20Transition%20Whitepaper.pdf]{{dead link|date=August 2017 |bot=InternetArchiveBot |fix-attempted=yes }}- "Surviving the Cisco CSA Transition" Endpoint Security Whitepaper
  • [Kaspersky.com Alternative to CSA]
  • [http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5739/ps2330/end_of_life_c51-602579.html End-of-Life Announcement] – Cisco Press Release
  • [http://www.cisco.com/en/US/products/sw/secursw/ps5057/index.html Cisco Security Agent] – Cisco's product page for the Agent software
  • [http://www.cisco.com/web/about/ciscoitatwork/case_studies/security_dl1.html Cisco IT Case Study] about Cisco Security Agent
  • [http://www.cisco.com/en/US/products/sw/secursw/ps976/prod_eol_notice09186a008018d90e.html Cisco IDS Host Sensor Migration Program]
  • [http://www.cisco.com/en/US/products/sw/secursw/ps976/prod_eol_notice09186a008032d4e6.html EOS and EOL of for the Cisco IDS Host Sensor Product Line]
  • [https://web.archive.org/web/20110615021641/http://www.networkworld.com/community/node/49121?source=NWWNLE_nlt_security_2009-12-18 Cisco hinted EOL for CSA] – Network World article

Category:Internet Protocol based network software

Category:Computer network security

Category:Windows security software

Category:Solaris software

Category:Cisco products