Device and user authentication events are some of the most common events occurring on a network and are also frequent indicators of attacks, ranging from brute force attacks to credential theft and malicious insiders. Both failed logins as well as successful logins can be signs of malicious activity depending on their characteristics. With the Authentication Content Pack, you can determine which login events are legitimate and which ones are not welcome.

Content Pack Components


Monitor successful and failed authentication events from devices that have monitored authentication services.

  • Administrator Login Overview
  • Detailed Administrator Logins
  • Failed Host Logins
  • Failed Services Logins
  • Successful Host Logins
  • Successful Services Logins

Required Products

  • McAfee Enterprise Security Manager (ESM) 11.x, 10.x
  • McAfee Advanced Correlation Engine (ACE) 11.x, 10.x

Download Content Pack

Registered ServicePortal users can log in to access the Knowledge Center for further documentation or to download the content pack file manually.

Read Article


Find other content packs and partner integrations.

See All

Free Trial

Interested in McAfee Enterprise Security Manager?