SlideShare a Scribd company logo

McAfee - Enterprise Security Manager (ESM) - SIEM

•Download as PPTX, PDF•
•
Iftikhar Ali Iqbal
Iftikhar Ali Iqbal

The presentation provides the following: - McAfee Company Overview - McAfee Strategy - McAfee Security Operations Overview - Security Operations Challenges - ESM Overview - ESM Components - ESM Architecture - ESM Architecture - Large Customer Sample - ESM Integrations - ESM Use Cases - Sample - ESM Incident Scenario - Sample - ESM - Security Operations Please note all the information is based prior to Jan 2020.

Technology
1 of 22
McAfee Enterprise Security Manager (ESM) Security Information & Event Management (SIEM) Iftikhar Ali Iqbal, CISSP, CCSP, CISM https://www.linkedin.com/in/iftikhariqbal/ Valid till Jan 2020
2 AGENDA Target Partners & RTM 1 2 3 Company Overview Security Operations Enterprise Security Manager (ESM) 4 Use Cases / Scenarios
OVERVIEW Company and Portfolio
4 SOLUTIONS SERVICES OPEN ARCHITECTURE BRIEF McAfee – the device-to-cloud cybersecurity company – is one of the largest pureplay cybersecurity companies in the world, with 30+ years of market leadership and 1,550+ patents worldwide. CASB Connect OpenDXL MCAFEE: OVERVIEW
5 Portfolio Strategy An Integrated And Open Security System Threat Defense Lifecycle Together, Is Far More Powerful Than Sum Of The Parts SECURITY OPERATIONS DEVICE CLOUD MANAGEMENT THREAT INTELLIGENCE ANALYTICS AUTOMATION / ORCHESTRATION INFRASTRUCTURE MCAFEE: STRATEGY
6 SIEM: Broad Data Collection Advanced Analytics: Risk scoring, anomaly detection SIEM: Long-term Compliance, archive & forensics SIEM: Real-time correlation & detection SIEM: Short-term Search & hunting Sandboxing: Malware Analysis EDR: Endpoint telemetry, process trace SIEM View all alerts, coordinate action Investigator: Automated analysis, guided investigation EDR: Response Collaboration with 3rd party solutions SIA Partner and Open Solutions Advanced Analytics Investigate and Act Collect, Enrich, and Share Data at any Scale Turn Data into Insight Data Platform Expert-guided Investigation for Confident Action ATDESMESM MAR/M EDR MAR /MEDRSIA MVISION EDR MCAFEE: SECURITY OPERATIONS
7 Time to Identify Time to Investigate Time to Contain Mean Time to Respond (MTTR) Mean Time to Detect (MTTD) 3-15 Months Dwell Time SECOPS: CHALLENGE
ENTERPRISE SECURITY MANAGER (ESM) Security Information & Event Management (SIEM)
9 Real Time Advanced Analytics Threat and Risk Prioritization INTELLIGENT INTEGRATED ACTIONABLE Comprehensive Security Broad Data Collection, Including Cloud Support Security Connected Integrations Active and Customizable Dashboards High Performance Data Management Engine Ease of Operation ! ESM: STRATEGIC OVERVIEW
10 ESM: ESSENTIALS CORRELATION • Event Normalization • Receiver & Advanced Correlation • Real-Time & Historical ‘Modes’ • Rule & Risk ’Engines’ MANAGEMENT • Dashboard Views • Threat Management & Intelligence • Content Packs (Use-Case Driven) • Policies & Rules ALARMS • Visual and Auditory • Text and Email • Case Management • Remote Commands • Watchlist DATA SOURCES • Security Events • Network Flow Data • Multi-Vendor • Various Types • Multi Method
11 ESM: COMPONENTS McAfee Enterprise Security Manager McAfee Enterprise Log Manager McAfee Application Data Monitor McAfee Database Security McAfee Advanced Correlation Engine McAfee Event Receivers Adaptive Risk Analysis and Historical Correlation Integrated SIEM & Log Management Rich Application and Database Context Scalable Collection and Distributed Correlation TIE/DXL SIA PartnersePO GTINSM Connected SolutionsIntegration and Operational Efficiency McAfee solutions empower organizations with visibility across systems, networks, and data, helping counter threats and mitigate risks. Physical & Virtual Appliances ATDMAR
12 Data Sources Enterprise Security Manager Application Data Monitor Event Receiver Advanced Correlation Engine (Real Time) Enterprise Log Manager TIP FW SEG DNS SEC IPS APT CASB Global Threat Intelligence Datacenter Security for Databases Advanced Correlation Engine (Historical) ESM: ARCHITECTURE Enterprise Log Search
13 ePolicy Orchestrator ICAP SMTP DLP Monitor DLP Discover DLP Prevent Web DLP Prevent Email DLP Prevent Mobile Mobile Device Management Secure Web Gateway Egress Switch MVISION Cloud API Threat Intelligence Exchange + Data Exchange Layer + Active Response Server Web Gateway (Pooled) Load Balancer McAfee Labs Global Threat Intelligence (GTI) Active Response – Cloud Storage Agent Handlers Next-Gen Endpoint Protection Endpoint Security Adaptive Threat Protection Active Response Data Loss Prevention Device Control DLP Endpoint Data Classification Web Proxy Client Proxy Physical Servers Virtual Servers McAfee Agent Next-Gen Server Protection Endpoint Security for Servers Adaptive Threat Protection Active Response Data Loss Prevention DLP Endpoint Data Classification Web Proxy Client Proxy HEADQUARTERS – MAIN DATA CENTER McAfee Agent Endpoints Next-Gen Endpoint Protection Endpoint Security Adaptive Threat Protection Active Response Device Control Client Proxy McAfee Agent Endpoints SITE # 1 Next-Gen Endpoint Protection Endpoint Security Adaptive Threat Protection Active Response Device Control Client Proxy McAfee Agent Endpoints SITE # 2 Active Directory Rights Management Services (RMS) Data Classification Enterprise Security Manager TIP FWSEG DNS SECIPSAPT CASB ApplicationData Monitor Event Receiver Advanced CorrelationEngine Enterprise Log Manager ` DataSources KafkaServiceBus Security Operations Center (SOC)
14 ESM: INTEGRATIONS OpenDXL ePolicy Orchestrator Advanced Threat Defense (Malware Analysis) Threat Intelligence Exchange Active Response MVISION EDR
USE CASES & SCENARIOS
16 ESM: USE CASES SCENARIOS MANAGEMENT MCAFEE SOLUTIONS THIRD PARTY COMPLIANCE BASEL II EU 8th Directive FISMA GLBA CPG 13 HIPAA ISO 27002 NERC PCI Compliance SOX . . . Aruba Cofense Interset PhishMe ThreatConnect Vormetric . . . Application Control Change Control Application Data Monitor Database Activity Database Event Monitor General Host Intrusion Prevention Network Security Platform Threat Intelligence Web Gateway . . . Executive Case Management Hardware Health . . . User Behavior Analytics Suspicious Activity Exfiltration Reconnaissance Asset, Threat & Risk Authentication Doman Name Service (DNS) Database Denial-of-Service (DoS) Domain Policy Exploit Firewall Malware . . . AlarmsViews ReportsCorrelation Rules WatchlistsData Sources (Product)
17 ESM: USE CASES – User Behavioral Analytics (UBA) • McAfee Advance Correlation Engine (ACE) • McAfee Global Threat Intelligence • Microsoft Windows Data Sources DATA SOURCES / PRODUCTS • Source User • Risk Suspicious Geo Events • User Behavior Events VIEWS • Security Groups • Accounts Not Requiring a Password • Accounts with Expired Password • Computer Accounts • Default Usernames • . • . • . WATCHLISTS • Domain Policy x 10 Rules • GTI x 2 Rules • UBA x 13 Rules • Windows Authentication x 8 Rules CORRELATION RULES Source User 1 Week REPORTS New User Logon Detected ALARMS
18 McAfee Endpoint Security ESM 2 DXL Fabric 3 MAR ESM: SCENARIO – ENDPOINT INCIDENT Identify malware activity early in the kill chain Security Analyst 2 ESM correlation rule alerts security analysts to possible attack using fileless techniques 4 Analyst performs validation with ELS and logs from web gateway Scenario Overview 5 Analyst performs scoping with Active Response 7 Analyst uses ESM to update Cyber Defense Countermeasures via OpenDXL 8 1 ENS logs Powershell and Blocks MimiKatz installation Incident Identification Incident Investigation Analysts pivots around events and declares incidents 6 Incident Containment Endpoint, Server, Cloud DNS and Network countermeasures are updated automatically via OpenDXL 1 Analyst performs validation with Active Response and ATD 4 5 6 7 8 8 Perimeter Firewall Data Center Firewall McAfee vIPS Cloud Protection 8 8 McAfee Server Security ATDELS 8 DNS Security
19 Time to Detect Time to Investigate Time to Contain Security Effectiveness Goals Process Efficiency Goals AVG 50% Process Automation with MTTR of under 10 Minutes 2 Analysts in this Use Case accessed 3 consoles only Detection – ENS, ATP Process Automation – 50% Analysts – 1 Consoles - 1 Investigation – ESM, ELS, MAR and ATD Process Automation – 25% Analysts – 1 Consoles - 3 Containment – ESM, DXL, Third Party Process Automation – 70% Analysts – 1 Consoles - 1 ESM: SCENARIO - ENDPOINT RESULTS
20 Modern, scalable platform for Sec Ops Security focus from day one Deep, high-quality integrations Modular scale-out data platform makes costs predictable Open source Kafka message bus removes data sharing tax Out-of-the-box use cases and analytics that require less configuration and professional support Innovative advanced analytics for detection and investigation assistance Tight integrations with other McAfee products Expansive dashboarding, automation, and orchestration with 130 SIA partners via DXL and direct capabilities ESM: KEY POINTS
21 SECURITY OPERATIONS: OPEN & INTEGRATED Local Threat Intelligence Reputation-based Protection File and Certificates STIX support Collaborative Ecosystem Data Exchange Layer Global Threat Intelligence (GTI) Sec. Info. & Event Mgmt. Integrated Log Management Scalable Collection Distributed Correlation Adaptive Risk Analysis Historical Correlation Rich Application Context Rich Database Context Various Integrations Integrations Local Threat Intelligence Advanced Threat Protection Intrusion Prevention System Endpoint Detection & Response Security Orchestration User & Entity Behavior Machine Learning User and Devices McAfee SIEM & Non-McAfee Remediation Actions Incident Response Evidence Collection Investigation Guides Coaching SIEM Ingestion
THANK YOU

Recommended

2012-12-12 Seminar McAfee ESM
2012-12-12 Seminar McAfee ESM2012-12-12 Seminar McAfee ESM
2012-12-12 Seminar McAfee ESMPinewood
 
The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)PECB
 
FireEye Solutions
FireEye SolutionsFireEye Solutions
FireEye SolutionsPrime Infoserv
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Frameworkn|u - The Open Security Community
 
PaloAlto Enterprise Security Solution
PaloAlto Enterprise Security SolutionPaloAlto Enterprise Security Solution
PaloAlto Enterprise Security SolutionPrime Infoserv
 
4_Session 1- Universal ZTNA.pptx
4_Session 1- Universal ZTNA.pptx4_Session 1- Universal ZTNA.pptx
4_Session 1- Universal ZTNA.pptxaungyekhant1
 
Fortinet Corporate Overview Deck.pptx
Fortinet Corporate Overview Deck.pptxFortinet Corporate Overview Deck.pptx
Fortinet Corporate Overview Deck.pptxArianeSpano
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)k33a
 

Recommended

2012-12-12 Seminar McAfee ESM
2012-12-12 Seminar McAfee ESM2012-12-12 Seminar McAfee ESM
2012-12-12 Seminar McAfee ESMPinewood
 
The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)The Next Generation of Security Operations Centre (SOC)
The Next Generation of Security Operations Centre (SOC)PECB
 
FireEye Solutions
FireEye SolutionsFireEye Solutions
FireEye SolutionsPrime Infoserv
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Frameworkn|u - The Open Security Community
 
PaloAlto Enterprise Security Solution
PaloAlto Enterprise Security SolutionPaloAlto Enterprise Security Solution
PaloAlto Enterprise Security SolutionPrime Infoserv
 
4_Session 1- Universal ZTNA.pptx
4_Session 1- Universal ZTNA.pptx4_Session 1- Universal ZTNA.pptx
4_Session 1- Universal ZTNA.pptxaungyekhant1
 
Fortinet Corporate Overview Deck.pptx
Fortinet Corporate Overview Deck.pptxFortinet Corporate Overview Deck.pptx
Fortinet Corporate Overview Deck.pptxArianeSpano
 
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM)k33a
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterMichael Nickle
 
Fortinet FortiOS 5 Presentation
Fortinet FortiOS 5 PresentationFortinet FortiOS 5 Presentation
Fortinet FortiOS 5 PresentationNCS Computech Ltd.
 
McAfee SIEM solution
McAfee SIEM solution McAfee SIEM solution
McAfee SIEM solution hashnees
 
Endpoint Detection & Response - FireEye
Endpoint Detection & Response - FireEyeEndpoint Detection & Response - FireEye
Endpoint Detection & Response - FireEyePrime Infoserv
 
Complete Endpoint protection
Complete Endpoint protectionComplete Endpoint protection
Complete Endpoint protectionxband
 
Cisco Security Presentation
Cisco Security PresentationCisco Security Presentation
Cisco Security PresentationSimplex
 
Building a Cyber Security Operations Center for SCADA/ICS Environments
Building a Cyber Security Operations Center for SCADA/ICS EnvironmentsBuilding a Cyber Security Operations Center for SCADA/ICS Environments
Building a Cyber Security Operations Center for SCADA/ICS EnvironmentsShah Sheikh
 
Beginner's Guide to SIEM
Beginner's Guide to SIEM Beginner's Guide to SIEM
Beginner's Guide to SIEM AlienVault
 
McAfee - McAfee Active Response (MAR) - Endpoint Detection & Response (EDR)
McAfee - McAfee Active Response (MAR) - Endpoint Detection & Response (EDR)McAfee - McAfee Active Response (MAR) - Endpoint Detection & Response (EDR)
McAfee - McAfee Active Response (MAR) - Endpoint Detection & Response (EDR)Iftikhar Ali Iqbal
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation CenterS.E. CTS CERT-GOV-MD
 
SOAR and SIEM.pptx
SOAR and SIEM.pptxSOAR and SIEM.pptx
SOAR and SIEM.pptxAjit Wadhawan
 
MITRE ATT&CK framework
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK frameworkBhushan Gurav
 
SIEM Primer:
SIEM Primer:SIEM Primer:
SIEM Primer:Anton Chuvakin
 
Azure Sentinel.pptx
Azure Sentinel.pptxAzure Sentinel.pptx
Azure Sentinel.pptxMohit Chhabra
 
SEIM-Microsoft Sentinel.pptx
SEIM-Microsoft Sentinel.pptxSEIM-Microsoft Sentinel.pptx
SEIM-Microsoft Sentinel.pptxAmrMousa51
 
Security architecture
Security architectureSecurity architecture
Security architectureDuncan Unwin
 
SOC and SIEM.pptx
SOC and SIEM.pptxSOC and SIEM.pptx
SOC and SIEM.pptxSandeshUprety4
 
Endpoint Protection
Endpoint ProtectionEndpoint Protection
Endpoint ProtectionSophos
 
Effective Cyber Defense Using CIS Critical Security Controls
Effective Cyber Defense Using CIS Critical Security ControlsEffective Cyber Defense Using CIS Critical Security Controls
Effective Cyber Defense Using CIS Critical Security ControlsBSides Delhi
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation centerMuhammad Sahputra
 
Overall Security Process Review CISC 6621Agend.docx
Overall Security Process Review CISC 6621Agend.docxOverall Security Process Review CISC 6621Agend.docx
Overall Security Process Review CISC 6621Agend.docxkarlhennesey
 
Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)Kangaroot
 

More Related Content

What's hot

SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterMichael Nickle
 
Fortinet FortiOS 5 Presentation
Fortinet FortiOS 5 PresentationFortinet FortiOS 5 Presentation
Fortinet FortiOS 5 PresentationNCS Computech Ltd.
 
McAfee SIEM solution
McAfee SIEM solution McAfee SIEM solution
McAfee SIEM solution hashnees
 
Endpoint Detection & Response - FireEye
Endpoint Detection & Response - FireEyeEndpoint Detection & Response - FireEye
Endpoint Detection & Response - FireEyePrime Infoserv
 
Complete Endpoint protection
Complete Endpoint protectionComplete Endpoint protection
Complete Endpoint protectionxband
 
Cisco Security Presentation
Cisco Security PresentationCisco Security Presentation
Cisco Security PresentationSimplex
 
Building a Cyber Security Operations Center for SCADA/ICS Environments
Building a Cyber Security Operations Center for SCADA/ICS EnvironmentsBuilding a Cyber Security Operations Center for SCADA/ICS Environments
Building a Cyber Security Operations Center for SCADA/ICS EnvironmentsShah Sheikh
 
Beginner's Guide to SIEM
Beginner's Guide to SIEM Beginner's Guide to SIEM
Beginner's Guide to SIEM AlienVault
 
McAfee - McAfee Active Response (MAR) - Endpoint Detection & Response (EDR)
McAfee - McAfee Active Response (MAR) - Endpoint Detection & Response (EDR)McAfee - McAfee Active Response (MAR) - Endpoint Detection & Response (EDR)
McAfee - McAfee Active Response (MAR) - Endpoint Detection & Response (EDR)Iftikhar Ali Iqbal
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation CenterS.E. CTS CERT-GOV-MD
 
MITRE ATT&CK framework
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK frameworkBhushan Gurav
 
SEIM-Microsoft Sentinel.pptx
SEIM-Microsoft Sentinel.pptxSEIM-Microsoft Sentinel.pptx
SEIM-Microsoft Sentinel.pptxAmrMousa51
 
Security architecture
Security architectureSecurity architecture
Security architectureDuncan Unwin
 
Endpoint Protection
Endpoint ProtectionEndpoint Protection
Endpoint ProtectionSophos
 
Effective Cyber Defense Using CIS Critical Security Controls
Effective Cyber Defense Using CIS Critical Security ControlsEffective Cyber Defense Using CIS Critical Security Controls
Effective Cyber Defense Using CIS Critical Security ControlsBSides Delhi
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation centerMuhammad Sahputra
 

What's hot (20)

SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations Center
 
Fortinet FortiOS 5 Presentation
Fortinet FortiOS 5 PresentationFortinet FortiOS 5 Presentation
Fortinet FortiOS 5 Presentation
 
McAfee SIEM solution
McAfee SIEM solution McAfee SIEM solution
McAfee SIEM solution
 
Endpoint Detection & Response - FireEye
Endpoint Detection & Response - FireEyeEndpoint Detection & Response - FireEye
Endpoint Detection & Response - FireEye
 
Complete Endpoint protection
Complete Endpoint protectionComplete Endpoint protection
Complete Endpoint protection
 
Cisco Security Presentation
Cisco Security PresentationCisco Security Presentation
Cisco Security Presentation
 
Building a Cyber Security Operations Center for SCADA/ICS Environments
Building a Cyber Security Operations Center for SCADA/ICS EnvironmentsBuilding a Cyber Security Operations Center for SCADA/ICS Environments
Building a Cyber Security Operations Center for SCADA/ICS Environments
 
Beginner's Guide to SIEM
Beginner's Guide to SIEM Beginner's Guide to SIEM
Beginner's Guide to SIEM
 
McAfee - McAfee Active Response (MAR) - Endpoint Detection & Response (EDR)
McAfee - McAfee Active Response (MAR) - Endpoint Detection & Response (EDR)McAfee - McAfee Active Response (MAR) - Endpoint Detection & Response (EDR)
McAfee - McAfee Active Response (MAR) - Endpoint Detection & Response (EDR)
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation Center
 
SOAR and SIEM.pptx
SOAR and SIEM.pptxSOAR and SIEM.pptx
SOAR and SIEM.pptx
 
MITRE ATT&CK framework
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK framework
 
SIEM Primer:
SIEM Primer:SIEM Primer:
SIEM Primer:
 
Azure Sentinel.pptx
Azure Sentinel.pptxAzure Sentinel.pptx
Azure Sentinel.pptx
 
SEIM-Microsoft Sentinel.pptx
SEIM-Microsoft Sentinel.pptxSEIM-Microsoft Sentinel.pptx
SEIM-Microsoft Sentinel.pptx
 
Security architecture
Security architectureSecurity architecture
Security architecture
 
SOC and SIEM.pptx
SOC and SIEM.pptxSOC and SIEM.pptx
SOC and SIEM.pptx
 
Endpoint Protection
Endpoint ProtectionEndpoint Protection
Endpoint Protection
 
Effective Cyber Defense Using CIS Critical Security Controls
Effective Cyber Defense Using CIS Critical Security ControlsEffective Cyber Defense Using CIS Critical Security Controls
Effective Cyber Defense Using CIS Critical Security Controls
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation center
 

Similar to McAfee - Enterprise Security Manager (ESM) - SIEM

Overall Security Process Review CISC 6621Agend.docx
Overall Security Process Review CISC 6621Agend.docxOverall Security Process Review CISC 6621Agend.docx
Overall Security Process Review CISC 6621Agend.docxkarlhennesey
 
Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)Kangaroot
 
Big Data For Threat Detection & Response
Big Data For Threat Detection & ResponseBig Data For Threat Detection & Response
Big Data For Threat Detection & ResponseHarry McLaren
 
Splunk for Security Breakout Session
Splunk for Security Breakout SessionSplunk for Security Breakout Session
Splunk for Security Breakout SessionSplunk
 
SplunkLive! - Splunk for Security
SplunkLive! - Splunk for SecuritySplunkLive! - Splunk for Security
SplunkLive! - Splunk for SecuritySplunk
 
Endpoint Protection as a Service (EPaaS)
Endpoint Protection as a Service (EPaaS)Endpoint Protection as a Service (EPaaS)
Endpoint Protection as a Service (EPaaS)PT Datacomm Diangraha
 
Security Information Event Management Security Information Event Management
Security Information Event Management Security Information Event ManagementSecurity Information Event Management Security Information Event Management
Security Information Event Management Security Information Event Managementkarthikvcyber
 
Esteban Próspero
Esteban PrósperoEsteban Próspero
Esteban PrósperoClusterCba
 
ManageEngine_SIEM_Log360_SOC.pptx
ManageEngine_SIEM_Log360_SOC.pptxManageEngine_SIEM_Log360_SOC.pptx
ManageEngine_SIEM_Log360_SOC.pptxTriLe786508
 
Introduction to SIEM.pptx
Introduction to SIEM.pptxIntroduction to SIEM.pptx
Introduction to SIEM.pptxneoalt
 
Cisco Connect 2018 Malaysia - Cybersecurity strategy-an integrated approach
Cisco Connect 2018 Malaysia - Cybersecurity strategy-an integrated approachCisco Connect 2018 Malaysia - Cybersecurity strategy-an integrated approach
Cisco Connect 2018 Malaysia - Cybersecurity strategy-an integrated approachNetworkCollaborators
 
Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)Ahmed Ayman
 
Slide Griffin - Practical Attacks and Mitigations
Slide Griffin - Practical Attacks and MitigationsSlide Griffin - Practical Attacks and Mitigations
Slide Griffin - Practical Attacks and MitigationsEnergySec
 
ASMC 2017 - Martin Vliem - Security < productivity < security: syntax ...
ASMC 2017 - Martin Vliem - Security < productivity < security: syntax ...ASMC 2017 - Martin Vliem - Security < productivity < security: syntax ...
ASMC 2017 - Martin Vliem - Security < productivity < security: syntax ...PlatformSecurityManagement
 
David Patterson IT Security Resumes 2016
David Patterson IT Security Resumes 2016David Patterson IT Security Resumes 2016
David Patterson IT Security Resumes 2016David Patterson
 
Elastic Security Brochure
Elastic Security BrochureElastic Security Brochure
Elastic Security BrochureJoseph DeFever
 
Big Data for Security - DNS Analytics
Big Data for Security - DNS AnalyticsBig Data for Security - DNS Analytics
Big Data for Security - DNS AnalyticsMarco Casassa Mont
 

Similar to McAfee - Enterprise Security Manager (ESM) - SIEM (20)

Overall Security Process Review CISC 6621Agend.docx
Overall Security Process Review CISC 6621Agend.docxOverall Security Process Review CISC 6621Agend.docx
Overall Security Process Review CISC 6621Agend.docx
 
Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)
 
Big Data For Threat Detection & Response
Big Data For Threat Detection & ResponseBig Data For Threat Detection & Response
Big Data For Threat Detection & Response
 
Splunk for Security Breakout Session
Splunk for Security Breakout SessionSplunk for Security Breakout Session
Splunk for Security Breakout Session
 
SplunkLive! - Splunk for Security
SplunkLive! - Splunk for SecuritySplunkLive! - Splunk for Security
SplunkLive! - Splunk for Security
 
Security Information Event Management - nullhyd
Security Information Event Management - nullhydSecurity Information Event Management - nullhyd
Security Information Event Management - nullhyd
 
Endpoint Protection as a Service (EPaaS)
Endpoint Protection as a Service (EPaaS)Endpoint Protection as a Service (EPaaS)
Endpoint Protection as a Service (EPaaS)
 
Security Information Event Management Security Information Event Management
Security Information Event Management Security Information Event ManagementSecurity Information Event Management Security Information Event Management
Security Information Event Management Security Information Event Management
 
Esteban Próspero
Esteban PrósperoEsteban Próspero
Esteban Próspero
 
ManageEngine_SIEM_Log360_SOC.pptx
ManageEngine_SIEM_Log360_SOC.pptxManageEngine_SIEM_Log360_SOC.pptx
ManageEngine_SIEM_Log360_SOC.pptx
 
Introduction to SIEM.pptx
Introduction to SIEM.pptxIntroduction to SIEM.pptx
Introduction to SIEM.pptx
 
XG Firewall
XG FirewallXG Firewall
XG Firewall
 
Cisco Connect 2018 Malaysia - Cybersecurity strategy-an integrated approach
Cisco Connect 2018 Malaysia - Cybersecurity strategy-an integrated approachCisco Connect 2018 Malaysia - Cybersecurity strategy-an integrated approach
Cisco Connect 2018 Malaysia - Cybersecurity strategy-an integrated approach
 
Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)
 
Slide Griffin - Practical Attacks and Mitigations
Slide Griffin - Practical Attacks and MitigationsSlide Griffin - Practical Attacks and Mitigations
Slide Griffin - Practical Attacks and Mitigations
 
ASMC 2017 - Martin Vliem - Security < productivity < security: syntax ...
ASMC 2017 - Martin Vliem - Security < productivity < security: syntax ...ASMC 2017 - Martin Vliem - Security < productivity < security: syntax ...
ASMC 2017 - Martin Vliem - Security < productivity < security: syntax ...
 
David Patterson IT Security Resumes 2016
David Patterson IT Security Resumes 2016David Patterson IT Security Resumes 2016
David Patterson IT Security Resumes 2016
 
Elastic Security Brochure
Elastic Security BrochureElastic Security Brochure
Elastic Security Brochure
 
Big Data for Security - DNS Analytics
Big Data for Security - DNS AnalyticsBig Data for Security - DNS Analytics
Big Data for Security - DNS Analytics
 
Security and-visibility
Security and-visibilitySecurity and-visibility
Security and-visibility
 

More from Iftikhar Ali Iqbal

McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Report
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC ReportMcAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Report
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC ReportIftikhar Ali Iqbal
 
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Docu...
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Docu...McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Docu...
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Docu...Iftikhar Ali Iqbal
 
McAfee - McAfee Application Control (MAC) - Whitelisting - Techbook
McAfee - McAfee Application Control (MAC) - Whitelisting - TechbookMcAfee - McAfee Application Control (MAC) - Whitelisting - Techbook
McAfee - McAfee Application Control (MAC) - Whitelisting - TechbookIftikhar Ali Iqbal
 
McAfee - McAfee Application Control (MAC) - Whitelisting - Proposal
McAfee - McAfee Application Control (MAC) - Whitelisting - ProposalMcAfee - McAfee Application Control (MAC) - Whitelisting - Proposal
McAfee - McAfee Application Control (MAC) - Whitelisting - ProposalIftikhar Ali Iqbal
 
McAfee - McAfee Application Control (MAC) - Whitelisting
McAfee - McAfee Application Control (MAC) - WhitelistingMcAfee - McAfee Application Control (MAC) - Whitelisting
McAfee - McAfee Application Control (MAC) - WhitelistingIftikhar Ali Iqbal
 
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB)
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB)McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB)
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB)Iftikhar Ali Iqbal
 
Symantec Data Loss Prevention - Technical Proposal (General)
Symantec Data Loss Prevention - Technical Proposal (General)Symantec Data Loss Prevention - Technical Proposal (General)
Symantec Data Loss Prevention - Technical Proposal (General)Iftikhar Ali Iqbal
 
Technology Overview - Validation & ID Protection (VIP)
Technology Overview - Validation & ID Protection (VIP)Technology Overview - Validation & ID Protection (VIP)
Technology Overview - Validation & ID Protection (VIP)Iftikhar Ali Iqbal
 
Technology Overview - Symantec IT Management Suite (ITMS)
Technology Overview - Symantec IT Management Suite (ITMS)Technology Overview - Symantec IT Management Suite (ITMS)
Technology Overview - Symantec IT Management Suite (ITMS)Iftikhar Ali Iqbal
 
Technology Overview - Symantec Data Loss Prevention (DLP)
Technology Overview - Symantec Data Loss Prevention (DLP)Technology Overview - Symantec Data Loss Prevention (DLP)
Technology Overview - Symantec Data Loss Prevention (DLP)Iftikhar Ali Iqbal
 
Technology Overview - Symantec Endpoint Protection (SEP)
Technology Overview - Symantec Endpoint Protection (SEP)Technology Overview - Symantec Endpoint Protection (SEP)
Technology Overview - Symantec Endpoint Protection (SEP)Iftikhar Ali Iqbal
 
Symantec Endpoint Encryption - Proof Of Concept Document
Symantec Endpoint Encryption - Proof Of Concept DocumentSymantec Endpoint Encryption - Proof Of Concept Document
Symantec Endpoint Encryption - Proof Of Concept DocumentIftikhar Ali Iqbal
 
Symantec Messaging Gateway - Technical Proposal (General)
Symantec Messaging Gateway - Technical Proposal (General)Symantec Messaging Gateway - Technical Proposal (General)
Symantec Messaging Gateway - Technical Proposal (General)Iftikhar Ali Iqbal
 
Symantec Endpoint Protection vs Sophos Endpoint Protection (Competitive Analy...
Symantec Endpoint Protection vs Sophos Endpoint Protection (Competitive Analy...Symantec Endpoint Protection vs Sophos Endpoint Protection (Competitive Analy...
Symantec Endpoint Protection vs Sophos Endpoint Protection (Competitive Analy...Iftikhar Ali Iqbal
 
Symantec Portfolio - Sales Play
Symantec Portfolio - Sales PlaySymantec Portfolio - Sales Play
Symantec Portfolio - Sales PlayIftikhar Ali Iqbal
 

More from Iftikhar Ali Iqbal (16)

McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Report
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC ReportMcAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Report
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Report
 
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Docu...
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Docu...McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Docu...
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Docu...
 
McAfee - McAfee Application Control (MAC) - Whitelisting - Techbook
McAfee - McAfee Application Control (MAC) - Whitelisting - TechbookMcAfee - McAfee Application Control (MAC) - Whitelisting - Techbook
McAfee - McAfee Application Control (MAC) - Whitelisting - Techbook
 
McAfee - McAfee Application Control (MAC) - Whitelisting - Proposal
McAfee - McAfee Application Control (MAC) - Whitelisting - ProposalMcAfee - McAfee Application Control (MAC) - Whitelisting - Proposal
McAfee - McAfee Application Control (MAC) - Whitelisting - Proposal
 
McAfee - McAfee Application Control (MAC) - Whitelisting
McAfee - McAfee Application Control (MAC) - WhitelistingMcAfee - McAfee Application Control (MAC) - Whitelisting
McAfee - McAfee Application Control (MAC) - Whitelisting
 
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB)
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB)McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB)
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB)
 
McAfee - Portfolio Overview
McAfee - Portfolio OverviewMcAfee - Portfolio Overview
McAfee - Portfolio Overview
 
Symantec Data Loss Prevention - Technical Proposal (General)
Symantec Data Loss Prevention - Technical Proposal (General)Symantec Data Loss Prevention - Technical Proposal (General)
Symantec Data Loss Prevention - Technical Proposal (General)
 
Technology Overview - Validation & ID Protection (VIP)
Technology Overview - Validation & ID Protection (VIP)Technology Overview - Validation & ID Protection (VIP)
Technology Overview - Validation & ID Protection (VIP)
 
Technology Overview - Symantec IT Management Suite (ITMS)
Technology Overview - Symantec IT Management Suite (ITMS)Technology Overview - Symantec IT Management Suite (ITMS)
Technology Overview - Symantec IT Management Suite (ITMS)
 
Technology Overview - Symantec Data Loss Prevention (DLP)
Technology Overview - Symantec Data Loss Prevention (DLP)Technology Overview - Symantec Data Loss Prevention (DLP)
Technology Overview - Symantec Data Loss Prevention (DLP)
 
Technology Overview - Symantec Endpoint Protection (SEP)
Technology Overview - Symantec Endpoint Protection (SEP)Technology Overview - Symantec Endpoint Protection (SEP)
Technology Overview - Symantec Endpoint Protection (SEP)
 
Symantec Endpoint Encryption - Proof Of Concept Document
Symantec Endpoint Encryption - Proof Of Concept DocumentSymantec Endpoint Encryption - Proof Of Concept Document
Symantec Endpoint Encryption - Proof Of Concept Document
 
Symantec Messaging Gateway - Technical Proposal (General)
Symantec Messaging Gateway - Technical Proposal (General)Symantec Messaging Gateway - Technical Proposal (General)
Symantec Messaging Gateway - Technical Proposal (General)
 
Symantec Endpoint Protection vs Sophos Endpoint Protection (Competitive Analy...
Symantec Endpoint Protection vs Sophos Endpoint Protection (Competitive Analy...Symantec Endpoint Protection vs Sophos Endpoint Protection (Competitive Analy...
Symantec Endpoint Protection vs Sophos Endpoint Protection (Competitive Analy...
 
Symantec Portfolio - Sales Play
Symantec Portfolio - Sales PlaySymantec Portfolio - Sales Play
Symantec Portfolio - Sales Play
 

Recently uploaded

Human Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR SystemsHuman Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR SystemsMark Billinghurst
 
New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024BookNet Canada
 
Presentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreterPresentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreternaman860154
 
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024BookNet Canada
 
SIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge GraphSIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge GraphNeo4j
 
Enhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for PartnersEnhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for PartnersThousandEyes
 
Unleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding ClubUnleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding ClubKalema Edgar
 
Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountBreaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountPuma Security, LLC
 
Install Stable Diffusion in windows machine
Install Stable Diffusion in windows machineInstall Stable Diffusion in windows machine
Install Stable Diffusion in windows machinePadma Pradeep
 
Scanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsScanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsRizwan Syed
 
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticsKotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticscarlostorres15106
 
AI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsAI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsMemoori
 
Artificial intelligence in the post-deep learning era
Artificial intelligence in the post-deep learning eraArtificial intelligence in the post-deep learning era
Artificial intelligence in the post-deep learning eraDeakin University
 
Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?Mattias Andersson
 
Unlocking the Potential of the Cloud for IBM Power Systems
Unlocking the Potential of the Cloud for IBM Power SystemsUnlocking the Potential of the Cloud for IBM Power Systems
Unlocking the Potential of the Cloud for IBM Power SystemsPrecisely
 
Understanding the Laravel MVC Architecture
Understanding the Laravel MVC ArchitectureUnderstanding the Laravel MVC Architecture
Understanding the Laravel MVC ArchitecturePixlogix Infotech
 
Pigging Solutions in Pet Food Manufacturing
Pigging Solutions in Pet Food ManufacturingPigging Solutions in Pet Food Manufacturing
Pigging Solutions in Pet Food ManufacturingPigging Solutions
 
Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024BookNet Canada
 
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationMy Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationRidwan Fadjar
 

Recently uploaded (20)

Human Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR SystemsHuman Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR Systems
 
New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
 
Presentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreterPresentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreter
 
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
 
SIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge GraphSIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge Graph
 
Enhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for PartnersEnhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for Partners
 
Unleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding ClubUnleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding Club
 
Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountBreaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path Mount
 
Install Stable Diffusion in windows machine
Install Stable Diffusion in windows machineInstall Stable Diffusion in windows machine
Install Stable Diffusion in windows machine
 
Scanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsScanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL Certs
 
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticsKotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
 
AI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsAI as an Interface for Commercial Buildings
AI as an Interface for Commercial Buildings
 
Artificial intelligence in the post-deep learning era
Artificial intelligence in the post-deep learning eraArtificial intelligence in the post-deep learning era
Artificial intelligence in the post-deep learning era
 
Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?
 
Unlocking the Potential of the Cloud for IBM Power Systems
Unlocking the Potential of the Cloud for IBM Power SystemsUnlocking the Potential of the Cloud for IBM Power Systems
Unlocking the Potential of the Cloud for IBM Power Systems
 
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptxE-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
 
Understanding the Laravel MVC Architecture
Understanding the Laravel MVC ArchitectureUnderstanding the Laravel MVC Architecture
Understanding the Laravel MVC Architecture
 
Pigging Solutions in Pet Food Manufacturing
Pigging Solutions in Pet Food ManufacturingPigging Solutions in Pet Food Manufacturing
Pigging Solutions in Pet Food Manufacturing
 
Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
 
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationMy Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 Presentation
 

McAfee - Enterprise Security Manager (ESM) - SIEM

  • 1. McAfee Enterprise Security Manager (ESM) Security Information & Event Management (SIEM) Iftikhar Ali Iqbal, CISSP, CCSP, CISM https://www.linkedin.com/in/iftikhariqbal/ Valid till Jan 2020
  • 2. 2 AGENDA Target Partners & RTM 1 2 3 Company Overview Security Operations Enterprise Security Manager (ESM) 4 Use Cases / Scenarios
  • 4. 4 SOLUTIONS SERVICES OPEN ARCHITECTURE BRIEF McAfee – the device-to-cloud cybersecurity company – is one of the largest pureplay cybersecurity companies in the world, with 30+ years of market leadership and 1,550+ patents worldwide. CASB Connect OpenDXL MCAFEE: OVERVIEW
  • 5. 5 Portfolio Strategy An Integrated And Open Security System Threat Defense Lifecycle Together, Is Far More Powerful Than Sum Of The Parts SECURITY OPERATIONS DEVICE CLOUD MANAGEMENT THREAT INTELLIGENCE ANALYTICS AUTOMATION / ORCHESTRATION INFRASTRUCTURE MCAFEE: STRATEGY
  • 6. 6 SIEM: Broad Data Collection Advanced Analytics: Risk scoring, anomaly detection SIEM: Long-term Compliance, archive & forensics SIEM: Real-time correlation & detection SIEM: Short-term Search & hunting Sandboxing: Malware Analysis EDR: Endpoint telemetry, process trace SIEM View all alerts, coordinate action Investigator: Automated analysis, guided investigation EDR: Response Collaboration with 3rd party solutions SIA Partner and Open Solutions Advanced Analytics Investigate and Act Collect, Enrich, and Share Data at any Scale Turn Data into Insight Data Platform Expert-guided Investigation for Confident Action ATDESMESM MAR/M EDR MAR /MEDRSIA MVISION EDR MCAFEE: SECURITY OPERATIONS
  • 7. 7 Time to Identify Time to Investigate Time to Contain Mean Time to Respond (MTTR) Mean Time to Detect (MTTD) 3-15 Months Dwell Time SECOPS: CHALLENGE
  • 8. ENTERPRISE SECURITY MANAGER (ESM) Security Information & Event Management (SIEM)
  • 9. 9 Real Time Advanced Analytics Threat and Risk Prioritization INTELLIGENT INTEGRATED ACTIONABLE Comprehensive Security Broad Data Collection, Including Cloud Support Security Connected Integrations Active and Customizable Dashboards High Performance Data Management Engine Ease of Operation ! ESM: STRATEGIC OVERVIEW
  • 10. 10 ESM: ESSENTIALS CORRELATION • Event Normalization • Receiver & Advanced Correlation • Real-Time & Historical ‘Modes’ • Rule & Risk ’Engines’ MANAGEMENT • Dashboard Views • Threat Management & Intelligence • Content Packs (Use-Case Driven) • Policies & Rules ALARMS • Visual and Auditory • Text and Email • Case Management • Remote Commands • Watchlist DATA SOURCES • Security Events • Network Flow Data • Multi-Vendor • Various Types • Multi Method
  • 11. 11 ESM: COMPONENTS McAfee Enterprise Security Manager McAfee Enterprise Log Manager McAfee Application Data Monitor McAfee Database Security McAfee Advanced Correlation Engine McAfee Event Receivers Adaptive Risk Analysis and Historical Correlation Integrated SIEM & Log Management Rich Application and Database Context Scalable Collection and Distributed Correlation TIE/DXL SIA PartnersePO GTINSM Connected SolutionsIntegration and Operational Efficiency McAfee solutions empower organizations with visibility across systems, networks, and data, helping counter threats and mitigate risks. Physical & Virtual Appliances ATDMAR
  • 12. 12 Data Sources Enterprise Security Manager Application Data Monitor Event Receiver Advanced Correlation Engine (Real Time) Enterprise Log Manager TIP FW SEG DNS SEC IPS APT CASB Global Threat Intelligence Datacenter Security for Databases Advanced Correlation Engine (Historical) ESM: ARCHITECTURE Enterprise Log Search
  • 13. 13 ePolicy Orchestrator ICAP SMTP DLP Monitor DLP Discover DLP Prevent Web DLP Prevent Email DLP Prevent Mobile Mobile Device Management Secure Web Gateway Egress Switch MVISION Cloud API Threat Intelligence Exchange + Data Exchange Layer + Active Response Server Web Gateway (Pooled) Load Balancer McAfee Labs Global Threat Intelligence (GTI) Active Response – Cloud Storage Agent Handlers Next-Gen Endpoint Protection Endpoint Security Adaptive Threat Protection Active Response Data Loss Prevention Device Control DLP Endpoint Data Classification Web Proxy Client Proxy Physical Servers Virtual Servers McAfee Agent Next-Gen Server Protection Endpoint Security for Servers Adaptive Threat Protection Active Response Data Loss Prevention DLP Endpoint Data Classification Web Proxy Client Proxy HEADQUARTERS – MAIN DATA CENTER McAfee Agent Endpoints Next-Gen Endpoint Protection Endpoint Security Adaptive Threat Protection Active Response Device Control Client Proxy McAfee Agent Endpoints SITE # 1 Next-Gen Endpoint Protection Endpoint Security Adaptive Threat Protection Active Response Device Control Client Proxy McAfee Agent Endpoints SITE # 2 Active Directory Rights Management Services (RMS) Data Classification Enterprise Security Manager TIP FWSEG DNS SECIPSAPT CASB ApplicationData Monitor Event Receiver Advanced CorrelationEngine Enterprise Log Manager ` DataSources KafkaServiceBus Security Operations Center (SOC)
  • 14. 14 ESM: INTEGRATIONS OpenDXL ePolicy Orchestrator Advanced Threat Defense (Malware Analysis) Threat Intelligence Exchange Active Response MVISION EDR
  • 15. USE CASES & SCENARIOS
  • 16. 16 ESM: USE CASES SCENARIOS MANAGEMENT MCAFEE SOLUTIONS THIRD PARTY COMPLIANCE BASEL II EU 8th Directive FISMA GLBA CPG 13 HIPAA ISO 27002 NERC PCI Compliance SOX . . . Aruba Cofense Interset PhishMe ThreatConnect Vormetric . . . Application Control Change Control Application Data Monitor Database Activity Database Event Monitor General Host Intrusion Prevention Network Security Platform Threat Intelligence Web Gateway . . . Executive Case Management Hardware Health . . . User Behavior Analytics Suspicious Activity Exfiltration Reconnaissance Asset, Threat & Risk Authentication Doman Name Service (DNS) Database Denial-of-Service (DoS) Domain Policy Exploit Firewall Malware . . . AlarmsViews ReportsCorrelation Rules WatchlistsData Sources (Product)
  • 17. 17 ESM: USE CASES – User Behavioral Analytics (UBA) • McAfee Advance Correlation Engine (ACE) • McAfee Global Threat Intelligence • Microsoft Windows Data Sources DATA SOURCES / PRODUCTS • Source User • Risk Suspicious Geo Events • User Behavior Events VIEWS • Security Groups • Accounts Not Requiring a Password • Accounts with Expired Password • Computer Accounts • Default Usernames • . • . • . WATCHLISTS • Domain Policy x 10 Rules • GTI x 2 Rules • UBA x 13 Rules • Windows Authentication x 8 Rules CORRELATION RULES Source User 1 Week REPORTS New User Logon Detected ALARMS
  • 18. 18 McAfee Endpoint Security ESM 2 DXL Fabric 3 MAR ESM: SCENARIO – ENDPOINT INCIDENT Identify malware activity early in the kill chain Security Analyst 2 ESM correlation rule alerts security analysts to possible attack using fileless techniques 4 Analyst performs validation with ELS and logs from web gateway Scenario Overview 5 Analyst performs scoping with Active Response 7 Analyst uses ESM to update Cyber Defense Countermeasures via OpenDXL 8 1 ENS logs Powershell and Blocks MimiKatz installation Incident Identification Incident Investigation Analysts pivots around events and declares incidents 6 Incident Containment Endpoint, Server, Cloud DNS and Network countermeasures are updated automatically via OpenDXL 1 Analyst performs validation with Active Response and ATD 4 5 6 7 8 8 Perimeter Firewall Data Center Firewall McAfee vIPS Cloud Protection 8 8 McAfee Server Security ATDELS 8 DNS Security
  • 19. 19 Time to Detect Time to Investigate Time to Contain Security Effectiveness Goals Process Efficiency Goals AVG 50% Process Automation with MTTR of under 10 Minutes 2 Analysts in this Use Case accessed 3 consoles only Detection – ENS, ATP Process Automation – 50% Analysts – 1 Consoles - 1 Investigation – ESM, ELS, MAR and ATD Process Automation – 25% Analysts – 1 Consoles - 3 Containment – ESM, DXL, Third Party Process Automation – 70% Analysts – 1 Consoles - 1 ESM: SCENARIO - ENDPOINT RESULTS
  • 20. 20 Modern, scalable platform for Sec Ops Security focus from day one Deep, high-quality integrations Modular scale-out data platform makes costs predictable Open source Kafka message bus removes data sharing tax Out-of-the-box use cases and analytics that require less configuration and professional support Innovative advanced analytics for detection and investigation assistance Tight integrations with other McAfee products Expansive dashboarding, automation, and orchestration with 130 SIA partners via DXL and direct capabilities ESM: KEY POINTS
  • 21. 21 SECURITY OPERATIONS: OPEN & INTEGRATED Local Threat Intelligence Reputation-based Protection File and Certificates STIX support Collaborative Ecosystem Data Exchange Layer Global Threat Intelligence (GTI) Sec. Info. & Event Mgmt. Integrated Log Management Scalable Collection Distributed Correlation Adaptive Risk Analysis Historical Correlation Rich Application Context Rich Database Context Various Integrations Integrations Local Threat Intelligence Advanced Threat Protection Intrusion Prevention System Endpoint Detection & Response Security Orchestration User & Entity Behavior Machine Learning User and Devices McAfee SIEM & Non-McAfee Remediation Actions Incident Response Evidence Collection Investigation Guides Coaching SIEM Ingestion