Device and user authentication events are some of the most common events occurring on a network and are also frequent indicators of attacks, ranging from brute force attacks to credential theft and malicious insiders. Both failed logins as well as successful logins can be signs of malicious activity depending on their characteristics. With the Authentication Content Pack, you can determine which login events are legitimate and which ones are not welcome.
Content Pack Components
Views
Monitor successful and failed authentication events from devices that have monitored authentication services.
- Administrator Login Overview
- Detailed Administrator Logins
- Failed Host Logins
- Failed Services Logins
- Successful Host Logins
- Successful Services Logins
Required Products
- McAfee Enterprise Security Manager (ESM) 11.x, 10.x
- McAfee Advanced Correlation Engine (ACE) 11.x, 10.x
Content pack demo
Content packs are available directly inside the McAfee Enterprise Security Manager user interface. Watch the video to discover how to access the content pack and get started.
Watch Video
Download Content Pack
Registered ServicePortal users can log in to access the Knowledge Center for further documentation or to download the content pack file manually.
Read Article