Is Cisco leaving MARS for dead?

I was a bit shocked to read several articles last week about Cisco’s apparent decision to stop adding new third party device support into Cisco MARS SEIM product. When I first read Ellen Messmer’s Network World story I thought perhaps Jerry Skurla over at Nitro was blowing smoke trying to stir up some FUD around the future of the Cisco product.  But it looks like other SIEM vendors have been hearing the same things. On top of that Cisco’s own spokesman came out with less then a ringing endorsement of MARS future. 

Usually in cases like this, where there is smoke there is fire.  Sounds like we could see MARS become a casualty of Cisco having too wide a focus. Between set top boxes, video conferencing, servers and virtualization, something has to give.  Could be some of the security stuff is what it is. It would be a shame though. I thought MARS was one of the better pieces of the Cisco security line up. It made their IPS so much more useable.