McAfee Enterprise Security Manager
Intelligent situational awareness, response, and reporting

Features & Benefits:

Monitor one complete picture of security activity
Use one environment to consolidate, correlate, and report on security information from heterogeneous devices at lightning speed.

Manage evolving threats with confidence
Integrate McAfee Global Threat Intelligence services and McAfee Risk Advisor with McAfee Enterprise Security Manager for a prioritized view of events, assets, and countermeasures.

Know how network and security events correlate to real business processes and policies
Provide contextual information (vulnerability scanners, identity, authentication management systems, privacy solutions, or other supported systems) to enrich each event with context, allowing for a better understanding of how network and security events correlate to real business processes and policies.

Set policies, rules, and thresholds that will generate alerts and launch mitigations
Drive instant corrective action, such as issuing new configurations, implementing new policies, and deploying software updates.

Reduce audit effort and expense for multiple regulations
Consolidate audit and compliance activities for over 240 regulations within a single pane of glass for continuous governance and rapid reporting.

Collect the data and context you need throughout your enterprise
Leverage our custom-built database engine and integration with McAfee ePolicy Orchestrator (McAfee ePO) software to extend visibility and control across your entire security and compliance management environment.

Critical Facts in Minutes, Not Hours

Our highly tuned database appliance can collect, process, and correlate billions of log events from multiple years with other data streams at the speed enterprises require. McAfee Enterprise Security Manager is able to store billions of events and flows, keeping all information available for immediate ad hoc queries, forensics, rules validation, and compliance.

Rapid access to long-term storage of event data is critical for investigating low-and-slow attacks, searching for indications of advanced persistent threats, or attempting to remediate a failed compliance audit—all of which require visibility into historical data and full access to the complete details of each specific event.

Massive Data Collection

A single McAfee Receiver can collect up to 18,000 events per second. The McAfee Enterprise Security Manager itself can support multiple distributed receivers, and is able to handle hundreds of thousands of events per second without compression or aggregation. With aggregation, a single appliance can support tens of millions of events per second—enough to address the demands of the largest enterprise networks.

Advanced Risk and Threat Detection

Whether it’s network traffic, user activity, or application use, any variation from normal activity could indicate that a threat is imminent, and your network is at risk. McAfee Enterprise Security Manager calculates baseline activity for all collected information across the enterprise—in real time—and alerts you of potential threats before they occur, while at the same time analyzing that data for patterns that could indicate a larger threat.

Context and Content Awareness

When contextual information is available—from vulnerability scanners, identity and authentication management systems, privacy solutions, or other supported systems—each event is enriched with that context, allowing for a better understanding of how network and security events correlate to real business processes and policies.

McAfee Enterprise Security Manager’s scalability and performance enables collection of more information from more sources, including application content such as documents, transactions, and communications, providing deep forensics value. All that information is heavily indexed, normalized and correlated to detect a wider range of risks and threats.

McAfee Global Threat Intelligence

An optional live feed of McAfee GTI IP Reputation data provides valuable, real-time information on external bad actors gathered from hundreds of millions of sensors around the globe allowing you to pinpoint malicious activity on your network. McAfee ESM can use the GTI IP Reputation data to quickly identify conditions where an internal host has communicated with a known bad actor.

Decisions Based on Risk and Asset Value

Integration with McAfee Risk Advisor enables real-time risk management. Complementing the McAfee GTI assessment of external risk factors, McAfee Risk Advisor (MRA) scores internal assets based on assigned value, providing you an environmental risk assessment. MRA provides accurate risk scores of end points based on asset configuration, vulnerability, and deployed controls along with available countermeasure options.

The McAfee ESM correlation engine associates the external GTI threat feeds with the internal MRA risk scores to surface the events that matter to your organization, saving you time and alerting you faster to potential problems. Visual indicators show trend activity across all dashboards for at-a-glance analysis.

Improved Event Management and Workflows

Automated actions let you use prioritization to manage security as risks change. For example, a watch list can be set to flag dangerous activities, such as contact with a known bad IP address. Or, you might use McAfee ePO to take a range of corrective actions: issue new configurations, implement new policies, or deploy a software update.

To enhance security operations, McAfee Enterprise Security Manager also provides integrated tools for configuration and change management, case management, and centralized management of policy—everything needed to improve workflow and facilitate daily information security operations.

Policy-Aware Compliance Management

McAfee Enterprise Security Manager makes compliance management easy with hundreds of pre-built dashboards, complete audit trails, and reports for PCI-DSS, HIPAA, NERC-CIP, FISMA, GLBA, SOX, and others. Our support for the Unified Control Framework also allows you to report your policies against more than 240 global regulations and control frameworks.

System Requirements:

Hardware Specifications1	ETM-X6	ETM-X4	ETM-6000	ETM-5600	ETM-4600-ELM	ETM-5600-ELM	ETM-6000-ELM
Collection Rates	300,000 events per second2	150,000 events per second2	70,000 events per second2	50,000 events per second2	1,000 events per second2	2,500 events per second2	5,000 events per second2
Analytical Performance	Less than 10 seconds3	Less than 30 seconds3	Less than 1 minute3	Less than 3 minutes3	Less than 3 minutes3	Less than 3 minutes3	Less than 1 minute3
Local Storage	14 TB4 + 3.2 TB Flash	14 TB4 + 800 GB SSD	14 TB4	8 TB4	3 TB4	8 TB4	14 TB4

1. All McAfee Enterprise Security Manager, Enterprise Log Manager, and additional McAfee SIEM appliance offerings are fault-tolerant appliances, including redundant array of independent disks (RAID) and redundant power supplies.
2. Based on typical network environments using average event and flow aggregation.
3. Indicates the average response time to generate a monthly report consisting of all events that occurred over a period of 30 days.
4. Represents usable event and flow storage, after RAID configuration.

Documentation:

Download the McAfee Enterprise Security Manager Datasheet (PDF).