- Chat with McAfee Ready to make a purchase or have questions before you buy? Chat with a McAfee expert. Available Monday to Friday.
- Find a Reseller
- Contact Me
- Get Security Notifications Now
- Call: 800-448-1657
Overview
McAfee Event Receiver appliances are responsible for the collection of log and event information from hundreds of third-party devices including firewalls, IDS/IPS devices, UTMs, switches, routers, applications, servers and workstations, identity and authentication systems, vulnerability assessment scanners, and more. McAfee Event Receiver uses a variety of collection methods including passive log collection, authenticated log collection, CEF, OPSEC, SDEE, XML, ODBC, as well as an encrypted collection validated to FIPS 140-2 Level 2.
Robust collection, powerful correlation — When a McAfee Event Receiver collects an event, it parses all relevant details into a fully normalized event taxonomy, and then provides full correlation against all events to detect larger incidents. McAfee Event Receiver correlates events collected by other distributed receivers for system-wide threat detection.
Flexible collection architecture — McAfee Enterprise Security Manager supports fully centralized “all-in-one” event collection and management, or fully distributed event collection using dedicated Event Receiver appliances, rated for several thousand to tens of thousands of events per second.
High reliability — Deploy McAfee Event Receiver redundantly for maximum reliability without any risk of data loss.
Features & Benefits
Get immediate access to data
Preserve and store all details of parsed and correlated events in a highly indexed database for fast retrieval and analysis.
Leverage flexible deployment options
Make highly distributed deployment easier and more cost effective with virtual appliances.
Retain and collect large amounts of security data
Collect over 20,000 events per second with a single McAfee Event Receiver. Every Event Receiver caches all collected data locally to preserve data in the event of a network communication error or outage.
System Requirements
| Hardware Specifications | ERC-4600 | ERC-3450 | ERC-2600 | ERC-1250 |
|---|---|---|---|---|
| Description | McAfee Event Receiver collects third-party logs, events, and data for correlation and analysis by McAfee Enterprise Security Manager | McAfee Event Receiver collects third-party logs, events, and data for correlation and analysis by McAfee Enterprise Security Manager | McAfee Event Receiver collects third-party logs, events, and data for correlation and analysis by McAfee Enterprise Security Manager | McAfee Event Receiver collects third-party logs, events, and data for correlation and analysis by McAfee Enterprise Security Manager |
| Collection Rates | 20,000 events per second | 15,000 events per second | 10,000 events per second | 5,000 events per second |
| Analytical Performance | N/A | N/A | N/A | N/A |
| Local Storage | 3 TB | 1.8 TB | 1.8 TB | 1 TB |
Demos / Tutorials
McAfee GTI and McAfee SIEM demo
Built for big security data, McAfee Global Threat Intelligence for McAfee Enterprise Security Manager (ESM) puts the power of McAfee Labs directly into the security monitoring flow using McAfee’s high-speed, highly intelligent security information and event management (SIEM) solution.
Awards / Reviews
McAfee Positioned as a Leader by Gartner in MQ for SIEM Based on Completeness of Vision and Ability to Execute
The security information and event management (SIEM) market is defined by the customer's need to analyze security event data in real time for internal and external threat management, and to collect, store, analyze and report on log data for regulatory compliance and forensics. The vendors that are included in Gartner’s analysis have technologies that have been designed for this purpose, and they actively market and sell these technologies to the security buying center.
McAfee Enterprise Security Manager Gets 5-Star Rating by SC Magazine
The McAfee Enterprise Security Manager is able to gather, store, and analyze logs and data from a large amount of sources and then correlate events based on rules, possible risk, or historical trends.
Customer Stories
McAfee
McAfee integrates NitroSecurity products into its portfolio, improving its SIEM offering.
Highlights
- Significantly shortens time to analyze security events from four to six days to less than 10 minutes
- Decreases time to produce PCI compliance reports from eight to 12 hours to 10 minutes
- Saves administrative time and manual maintenance while eliminating unnecessary activities
- Facilitates disaster recovery and allows for proper use of virtual machines
- Improves the organization’s overall security posture in the industry
News / Events
News
- McAfee Unveils the First Situational and Risk Aware SIEM
April 24, 2012Topics : Risk & Compliance, Security Management, SIEM
- McAfee, Inc. to Acquire NitroSecurity – Advances Security Risk Management
October 4, 2011Topics : SIEM
Events
No results foundOn Demand
- McAfee ESM: Fulfilling the Promise of SIEM
On Demand Webcast
Resources
Focus on 5: Threat Intelligence SIEM Requirements
McAfee spoke with customers about integrating SIEM with Threat Intelligence and how it helped their effort to mitigate bad actors.
Focus on 5: SIEM Requirements
Learn about the top five issues with SIEM: Big Security Data, Content and User Awareness, Dynamic Context, Solution Customization, and Business Value.
Data Sheets
Reports
Technology Blueprints
White Papers
Community
Forums
No results foundBlogs
- Making progress in Recognizing Risk for Medical Devices
Kim Singletary - June 18, 2013
The FDA recently released a new warning regarding medical devices, malware and cyber-security. The recommendations are sound and reflect progress since the release of the United States Government Accountability Office report on Medical Devices citing a need for expanding information security. Any implantable medical device has a planned lifespan for ten years because undergoing major surgery more Read more... - FDA Urges Medical Device Manufacturers to Strengthen Security
Teresa Chen - June 18, 2013
We’ve all seen headlines about the growing numbers of medical devices being infected by malware. Recently, the Wall Street Journal reported at least 327 devices at Veterans Affairs (VA) hospitals have been compromised since 2009. Taking action, the U.S. Food and Drug Administration (FDA) is urging device manufacturers and health care facilities to be more vigilant Read more... - Why whitelisting is ready for Enterprise desktops
Kim Singletary - June 17, 2013
When I was first introduced to whitelisting now over five years ago I was considering this technology for critical shared systems and looking at ways to manage remote operations. Dynamic whitelisting as a control to deny execution and access to system resources unless there was explicit trust of the applications and executables was a very Read more... - McAfee ESM named Leader in 2013 Gartner Magic Quadrant for SIEM
Gretchen Hellman - June 12, 2013
McAfee announced this week that our SIEM (security information and event management) offering has been positioned as a “Leader” in the 2013 Gartner Magic Quadrant for Security Information and Event Management. According to the report, Leaders provide “technology that is a good match to current customer requirements. Leaders also show evidence of superior vision and Read more... - Microsoft Patch Tuesday Report: BYOD in Focus
Scott Taschler - June 11, 2013
Today Microsoft released 5 patches which addressed 23 individual vulnerabilities. Only one patch is identified by Microsoft as “critical” and resolves 19 reported vulnerabilities in Internet Explorer. Looking over the patches I would like to highlight the following two patches: MS13-047: This is the bulk of the update consisting of patches for 19 critical vulnerabilities Read more...