Trellix Enterprise Security ManagerFormerly McAfee Enterprise Security Manager
Overview
What is Trellix Enterprise Security Manager?
Trellix Enterprise Security Manager (formerly McAfee Enterprise Security Manager) is security information and event management (SIEM) software.
Identification, neutralization and investigation of threats
A robust SIEM solution for medium/large companies
Overall, A Great Value Security Solution
Manage you events
Best SIEM
McAfee ESM, a cautionary tale
SIEM causing Anger then use Enterprise Security Manager
ESM is great, McAfee AV, not so much
Popular Features
- Centralized event and log data collection (9)8.787%
- Deployment flexibility (9)8.383%
- Event and log normalization/management (9)8.080%
- Correlation (9)7.070%
Pricing
What is Trellix Enterprise Security Manager?
Trellix Enterprise Security Manager (formerly McAfee Enterprise Security Manager) is security information and event management (SIEM) software.
Entry-level set up fee?
- No setup fee
Offerings
- Free Trial
- Free/Freemium Version
- Premium Consulting / Integration Services
Would you like us to let the vendor know that you want pricing?
26 people also want pricing
Alternatives Pricing
What is Trellix Helix?
Trellix Helix (formerly FireEye Helix) is a SIEM solution providing a non-malware threat detection solution.
What is InsightIDR?
In addition to their incident response service, Rapid7 offers InsightIDR, a combined XDR and SIEM that provides user behavior and threat analytics.
Features
Security Information and Event Management (SIEM)
Security Information and Event Management is a category of security software that allows security analysts to look at a more comprehensive view of security logs and events than would be possible by looking at the log files of individual, point security tools
- 8.7Centralized event and log data collection(9) Ratings
Effectiveness of real-time centralized event and log data collection
- 7Correlation(9) Ratings
Correlation of logs and events to pinpoint significant threats
- 8Event and log normalization/management(9) Ratings
Ability to normalize event syntax so that logs can be compared and are machine-understandable
- 8.3Deployment flexibility(9) Ratings
Ability to tune system to maximize threat detection and minimize false positives
- 9.3Integration with Identity and Access Management Tools(7) Ratings
Integration with access control tools like Active Directory and LDAP
- 9.3Custom dashboards and workspaces(9) Ratings
dashboards that can be customized to meet the needs of specific groups
- 8.3Host and network-based intrusion detection(7) Ratings
Ability to detect both endpoint intrusion and network ingress detection
- 9.3Data integration/API management(2) Ratings
Ease and quality of data integrations between SIEM and other systems
- 8.7Behavioral analytics and baselining(2) Ratings
How effectively activity and behavior baselines are established and maintained
- 8.7Rules-based and algorithmic detection thresholds(2) Ratings
Effectiveness of manually-established rules and algorithmically-determined detection thresholds
- 8Response orchestration and automation(2) Ratings
Quality of built-in response orchestration and automation in Next-Gen SIEM
- 8.7Reporting and compliance management(2) Ratings
Ease and quality of reporting and compliance functions
- 7.7Incident indexing/searching(2) Ratings
Effectiveness of searching across structured and unstructured events and incidents within SIEM
Product Details
- About
- Tech Details
- FAQs
What is Trellix Enterprise Security Manager?
Trellix Enterprise Security Manager Technical Details
Operating Systems | Unspecified |
---|---|
Mobile Application | No |
Frequently Asked Questions
Comparisons
Compare with
Reviews and Ratings
(39)Attribute Ratings
Reviews
(1-9 of 9)- Runs on Startup
- User-Friendly
- Identifies Threats
- Customer Outreach
- IT Support
- Overall Aesthetic
- Allows data analysis for patterns that may indicate a threat
- Real-time activity visibility
- Gives technology support intelligence by creating prioritized alerts that reveal potential threats before they happen
- Problem reporting is integrated and simplifies analysis and compliance operations
- Reports can be difficult to analyze
- There is little training for technology teams to master the key features of the tools
- Our team may have problems locating errors in our country's bases
- Reports can be difficult to customize and adapt
A robust SIEM solution for medium/large companies
- Good parsing capability
- Enables integrations
- The user interface is not the best, it is still based on Flash player (but they have plans to migrate to HTML5).
- While the "user" interface is pretty straight forward, the management interface is fairly complicated.
In my opinion, I wouldn't recommend McAfee for small companies, since it's not that easy to manage and maintain.
Overall, A Great Value Security Solution
- Updated and current incident libraries.
- It monitors the entire enterprise network proactively.
- Its monitoring activities do not impact the network.
- Widen more its integration capabilities, such as integration to some cloud platforms.
Manage you events
- Integration with other software
- Log sources integration
- Very user friendly interface
- Real-time monitoring
- Pre-defined reports
- The system requirements are quite demanding
- No other tool issue or operational issue was identified
Best SIEM
- Identify brute force attaks
- Anomalous traffic detection
- Faster ingestion and query performance
- Can collect large volumes of events
- Operating in all bowsers
- Documentation detailation
- Simplify the process of creation core relation rules
McAfee ESM, a cautionary tale
- McAfee Enterprise Security Manager has a large library of pre-made correlations that reduces the amount of work needed to make it functional.
- This is a core McAfee product that is still getting support.
- It has a substantial amount of compatibility and integration with other products.
- The migration off of Flash has been painful. The new interface is very difficult to work with. Even support tends to fall back to the Flash version.
- The GUI is not intuitive under any version. Finding settings takes a significant amount of learning.
- While the product is supported, the transitions from various directions have left the future of the product in question. It used to be the interface for IDS, but the new IDS is stand alone.
- The way McAfee has dropped products with no warning in the past makes us skeptical of trusting any stated roadmap.
SIEM causing Anger then use Enterprise Security Manager
- Advanced Threat intelligence gives us the ability to prioritise alerts quickly and efficiently.
- SIEM log collection allows us to integrate our other Intel products to a centralised point.
- Physical appliances is one of the areas we have moved away from, so the ability for ESM to be available as a VDI was key.
- If there is a requirement to integrate into other vendor products i.e. (log sharing) then this was very cumbersome.
- Integration of vulnerability scanning that is available in other vendor products would be a good addition.
- When integrating all of Intel's products a third party consultancy is usually required, where other vendor products can be configured without this additional cost.
McAfee Enterprise Security Manager is well placed when the environment has other Intel products. We operate McAfee Move and the two products work extremely well together. The anti-virus product can be very cumbersome if used with another SIEM solution when log collecting.
We have other areas where intel solutions are not in use and in these circumstances we used another well-known SIEM solution that had an easier implementation phase than Intel's and where remote access was challenging.
ESM is great, McAfee AV, not so much
- It is a great central management tool with great reports and dashboards.
- It can easily show devices out of compliance.
- ESM is easy to manage and maintain.
- Some tools it manages lack features.
- ESM can have some issues with upgrading.
- MFA support is needed.