McAfee Enterprise Security Manager 9.2 用户指南

需积分: 9 134 浏览量更新于2024-07-21 1 收藏 14.34MB PDF 举报

McAfee SIEM User Guide 9.2 版本 McAfee Security Event Manager (SIEM) 是一款企业级的安全信息和事件管理解决方案，用于收集、分析和响应网络安全事件。这份文档主要介绍了McAfee ESM Console的帮助内容，涵盖了系统介绍、开始使用以及与之相关的各种组件和功能。 I. McAfee ESM Console Help 部分提供了对McAfee ESM控制台的详细指导，包括用户界面和各个组件的功能。 1. McAfee ESM System概述：这是一个集成的安全管理系统，负责收集和处理来自网络设备、安全设备和其他数据源的事件。 2. McAfee ESM Interface：这是用户与系统交互的主要界面，用于监控、分析和管理安全事件。 3. McAfee Nitro IPS：这是一款入侵防御系统，能实时检测并阻止潜在的攻击。 4. McAfee Event Receiver：负责接收和处理来自网络的各种安全事件。 5. McAfee ESM：核心组件，执行事件分析、关联和报告。 6. McAfee Data Exchange Layer (DEM)：提供数据共享和集成，允许与其他McAfee产品和其他第三方工具通信。 7. McAfee Active Response (ADM)：提供了对事件的实时响应能力，可以自动或手动调查可疑活动。 8. McAfee Advanced Correlation Engine (ACE)：用于复杂事件分析，通过智能算法发现潜在威胁。 9. McAfee Distributed ESM：分布式架构，支持在多个位置部署以提高可扩展性和性能。 10. McAfee Event Logger Manager (ELM)：记录和存储安全事件，支持长期保留和合规性需求。 11. General System Information：涵盖系统的基本信息，如最低配置要求。 12. Minimum Requirements：列出运行McAfee ESM所需的硬件和软件最低规格。 13. Security Features：强调系统提供的安全特性，可能包括加密、访问控制等。 14. FIPS Mode：遵循美国联邦信息处理标准（FIPS）的模式，确保数据加密符合政府法规。 II. Getting Started with McAfee ESM Console 部分指导用户如何开始使用系统。 1. New Features in 9.2：列出新版本9.2中的改进和新增功能。 2. Quick Start Guide：快速入门指南，帮助用户快速设置和使用系统。 3. SetUp the System：包括安装和配置系统的步骤。 4. Add Devices to the System：说明如何将网络设备添加到ESM以进行监控和管理。 5. Configure the Device Properties：详细解释如何定制设备属性以适应特定环境。 6. SetUp the Views：创建和定制视图，以便根据需要呈现事件和警报。 7. Correlation：事件关联功能的设置和使用，帮助识别复杂的威胁模式。 8. General Options：调整系统的一般设置和参数。 9. Help：关于系统使用的在线帮助资源。 10. Selecting FIPS Mode：说明如何启用FIPS模式以满足安全策略。 III. McAfee ESM Console部分详细介绍控制台的各项功能。 1. ESM Navigation Bar：提供快速访问系统功能的导航栏。 2. Options：设置和配置系统选项，以优化用户体验。 3. User Settings：用户个人设置，如语言、首选项和权限。 4. Colors：自定义界面颜色方案，以提高可读性和个性化。 5. Views：管理和创建视图，以显示和组织事件和报警。 6. ESM System Navigation：如何在系统中导航和操作。 7. Organizing Your Devices：有效地组织和管理网络中的设备。 8. Get Events and Flows：获取和解析事件流，以理解网络活动。 9. Multi-Device Management：同时管理多个设备，提高效率。 10. View Streaming Events：实时查看事件流，及时发现异常。 11. View Files for McAfee ELM Data Sources：查看与ELM数据源相关的文件。 12. Health Status Reports：生成健康状况报告，评估系统和设备的状态。 13. Device Status Alerts Summary：设备状态警报摘要，提供设备运行状况的概览。这些内容为McAfee SIEM的使用者提供了全面的指导，帮助他们有效地利用该系统来保护企业的网络安全，提高威胁检测和响应能力。

McAfee ESMI User Guide16

1 McAfee ESM Console Help

This user guide presents general information about the McAfee ESM system as well as

detailed instructions for actions that will be required to manage the system and its

corresponding devices. The audience for this help includes network administrators who

have a broad range of experience and expertise in network management and security.

This document is divided into eight main sections:

Introduction to the System - Presents information about the different system

components, how they interact, system requirements and security features, and a

brief discussion about operating the system in Federal Information Processing

Standard (FIPS) mode.

Getting Started with the ESM console - Describes how to select the FIPS mode for

your system, gives an overview of the McAfee ESM console features, contains a quick

start guide, and presents the features that are new in this version.

System Configuration - Contains a detailed description of all of the features that are

available to you as you configure your system, and directions for using these features.

It includes configuration for all device types.

Case Management - Describes how to use the Case Manager to assign and track work

items and support tickets associated with network events.

Views - Discusses how the View portion of the ESM console functions, the options that

are available, and how to set up custom views.

Policy Editor - Discusses how to create configurable, simple, and easy-to-use policy

templates for the devices. In addition, it covers importing and exporting policy

settings, viewing differences between policies, examining exceptions between parent

and child policies, rolling out policies, and restoring policies to a previous point. It also

allows you to import, export, add, edit, and perform various operations on rules.

Asset Manager - Provides a centralized location that allows you to discover, manually

create, and import assets. It includes assets, configuration management, network

discovery, asset sources, vulnerability assessment, and zone management.

Appendixes - The appendixes include additional details regarding the ESM, Third

Party, FIPS mode, Common Criteria, data source configuration for external devices,

and working with Windows Event Collectors.

The following unique character formatting and various symbols are used to help enhance

the usability of this document:

System buttons, dialog boxes, and menu items are italicized (e.g., Devices, New Rule

Introduction to the System 19

McAfee Event Receiver

The McAfee Event Receiver enables the collection of security events and network flow data

from multi-vendor sources including firewalls, virtual private networks (VPNs), routers,

Nitro IPS/IDS, NetFlow, sFlow, and others. The Receiver is an integral component of a

comprehensive security management solution with the ability to gather and analyze data

from third-party network and security solutions. The Receiver allows for the collection of

this data and normalizes it into a single manageable solution. This provides the user a

single view across devices from multiple vendors, such as Cisco, Check Point, Juniper, and

McAfee. This allows event and flow data collection from Nitro IPS devices and routers that

send data feeds to the Receiver.

The Receiver is unique due to a patented ultra-high-performance aggregation and

correlation engine that is integrated into each McAfee Event Receiver. These sophisticated

data acquisition and management capabilities give the Receiver the power to manage

thousands of events per second. It is this correlation of both event and flow data that

provides the user a more in-depth view into potential threats.

Some of the other abilities of the Receiver include producing its own network flow

information without the need for NetFlow and the duplication of inbound data feeds for

archival purposes. The Receiver can be placed on a network tap or span port to provide

flow data for use in the ESM solution. This enables the enterprise to leverage flow analysis

in networks that do not support NetFlow or sFlow. Also, the Receiver will replicate the

device feeds and forward them to a customer-provided storage device for long-term

storage and backup.

McAfee ESM

The McAfee Enterprise Security Manager (ESM) is the central point of administration for

data, settings, and configuration. Using an ESM allows network administrators to keep all

configuration settings, user and access group profiles, and event and flow data in a single

location. The ESM can be involved in communication with multiple devices

simultaneously. An ESM manages all devices and performs correlations.

The ESM communicates with devices via an encrypted control channel. The devices

respond to control packets sent by an ESM with the proper communications key. In order

for a control packet to be processed, it must be decrypted. An attacker wanting to intercept

and examine the packet being processed would either have to know the encryption key or

be able to guess it.

The ESM retrieves software and rule updates from McAfee’s central rule server through an

McAfee ESMI User Guide20

encrypted communication mechanism.

McAfee DEM

McAfee Database Event Monitor (DEM), McAfee’s award-winning database auditing

solution, automates the collection, management, analysis, and visualization/reporting of

database access for virtually all popular database platforms. It delivers a comprehensive,

detailed security auditing solution for web and database applications vulnerable to insider

theft and application-layer attacks. By monitoring all access to sensitive corporate and

customer data, McAfee DEM ensures a proactive approach to data security.

DEM scales to meet the needs of the largest enterprises while minimizing the cost and

complexity of IT governance, compliance, and data security. To accelerate time-to-value,

McAfee DEM is available as preconfigured hardened Linux appliances and includes

preconfigured rules and reports for common business problems including Sarbanes-

Oxley, HIPAA, PCI, FISMA, and others.

Additionally, McAfee DEM provides continuous, real-time audit trails of all database

activity by intelligently analyzing the underlying database application protocols. It can

monitor logins, logouts, and failed login attempts, alert on unauthorized access from

particular logins or client computers, and alert on access to specific objects. It can also

capture data changes originated by users and track administrator-initiated access control

or schema changes. It even provides a complete audit trail of all requests that can be

replayed in a controlled environment.

Features of McAfee DEM include:

Non-intrusive, 24/7 compliance monitoring of all database and application activity.

Detailed, automated, policy-based security audit of databases.

Real-time alerts.

Activity, violation, and performance reports.

No change required to applications.

Custom analysis, reporting, and integrating with your portal.

McAfee ADM

The McAfee Application Data Monitor (ADM) passively monitors traffic captured using

the Nitro IPS driver. It monitors, decodes, and detects anomalies in the following

application protocols:

File Transfer: FTP, HTTP, SSL (setup/certificates only)

剩余1328页未读，继续阅读

wanglei16

粉丝: 0
资源: 12

McAfee Enterprise Security Manager 9.2 用户指南

McAfee Endpoint Security 10.6 正版授权杀毒软件

McAfee多国语言包v4.5

McAfee企业版 v8.8

esm:McAfee SIEM API-Jupyter笔记本

esm2markdown:McAfee SIEM Rule Converter的转换器将文件导出到Markdown文档

McAfee SIEM解决方案：实时威胁检测与智能安全管理

关于McAfee安全战略和开放安全平台的分析说明.zip

智能安全运维：新一代SOC与SIEM解决方案

Python实现McAfee ESM API代码详解

麦咖啡破解版

最新资源