Trellix ESM Reviews

I use Trellix ESM to monitor inbound communication from known threat hosts and detect cyberattacks. It's also useful for outbound communication, but we block threat communication via a firewall.

The tool's effectiveness depends on how you define your log sources. To build visibility of incoming and outgoing traffic, you need logs from perimeter defense, firewalls, web application firewalls, and endpoint protection. With good traffic visibility, incident response time is really quick.

Trellix ESM provides situation awareness. On the dashboard, I can see outbound and inbound communications to known threat hosts, IPS/IDS activity, and threat intelligence of the perimeter defense in the firewall. This information helps preempt attacks.

The primary use case of the solution is central log management for the company. It allows us to see all the traffic coming in and going out to and from the internet. It provides various views from the firewall and web application firewall and event logs from the endpoint. The command view will tell us the current status of the threats from various threat sources. While the normalized view will give us correlated events from sources to destinations and related applications.

It provides threat monitoring from the Internet and if there is malicious activity on the end-point, the ESM can provide us what host is affected. 

We use McAfee for security features.

The product’s most valuable feature is log monitoring.

We use the product to protect endpoint nodes.

The product works better than other vendors available in the market. It can be easily deployed with the other solutions.

McAfee ESM is utilized to gather logs from Microsoft Windows servers and Palo Alto firewalls.

The support I have received from the vendor has been great.

In my company, we don't use Trellix ESM in our environment because we are a small company, but we have implemented it for our customers.

My company's customers use Trellix ESM to monitor and report on servers in their environment. My company's customers also have some of the virtual machines in their environment, along with firewalls integrated into Trellix ESM.

The most valuable feature of the solution is that the integration is really easy. Using the product is very easy. The product is user-friendly, but its use needs to be planned.

McAfee ESM is used for my customers in the financial sector.

The most valuable features of McAfee ESM are intrusion detection, malware protection, and the device controller.

Trellix ESM utilizes fewer human resources and improves security and visibility.

It is more difficult to operate Trellix ESM than other solutions.