Trellix ESM Reviews

I am working with something that is similar to Trellix ESM for event management. It is similar to Trellix Enterprise Security Manager.

Mainly compliance is the primary concern where organizations have to have log retention for more than six months, one year, or six years, depending on the compliance applicable to the organization for the Enterprise Security Manager. And Trellix gives us good reporting. 

I use Trellix ESM to monitor inbound communication from known threat hosts and detect cyberattacks. It's also useful for outbound communication, but we block threat communication via a firewall.

The tool's effectiveness depends on how you define your log sources. To build visibility of incoming and outgoing traffic, you need logs from perimeter defense, firewalls, web application firewalls, and endpoint protection. With good traffic visibility, incident response time is really quick.

Trellix ESM provides situation awareness. On the dashboard, I can see outbound and inbound communications to known threat hosts, IPS/IDS activity, and threat intelligence of the perimeter defense in the firewall. This information helps preempt attacks.

We use McAfee for security features.

The product’s most valuable feature is log monitoring.

We use the product to protect endpoint nodes.

The product works better than other vendors available in the market. It can be easily deployed with the other solutions.

In my company, we don't use Trellix ESM in our environment because we are a small company, but we have implemented it for our customers.

My company's customers use Trellix ESM to monitor and report on servers in their environment. My company's customers also have some of the virtual machines in their environment, along with firewalls integrated into Trellix ESM.

The most valuable feature of the solution is that the integration is really easy. Using the product is very easy. The product is user-friendly, but its use needs to be planned.

The primary use case of the solution is central log management for the company. It allows us to see all the traffic coming in and going out to and from the internet. It provides various views from the firewall and web application firewall and event logs from the endpoint. The command view will tell us the current status of the threats from various threat sources. While the normalized view will give us correlated events from sources to destinations and related applications.

It provides threat monitoring from the Internet and if there is malicious activity on the end-point, the ESM can provide us what host is affected. 

McAfee ESM is used for my customers in the financial sector.

The most valuable features of McAfee ESM are intrusion detection, malware protection, and the device controller.

McAfee ESM is utilized to gather logs from Microsoft Windows servers and Palo Alto firewalls.

The support I have received from the vendor has been great.