How to Add Data Sources in ESM

Question 1

What are common formats an ERC can collect (mention 3)?

Answer 1

• Syslog
• WMI
• SNMP
• Snare or the Trellix Agent for Windows logs
• MEF - McAfee Event Formats for custom log settings
• Netflow (generic Netflow, sFlow)

Question 2

Why would you need to create a system profile to add data sources on ESM?

Answer 2

To pre-populate parameters, this is helpful when you have a lot of data sources of the same type

Question 3

How can you add a Data Source profile on ESM?

Answer 3

• Clic on ESM properties
• Clic on Profile Managament

Question 4

What does the Receiver’s Data Source - Auto Learn feature provide?

Answer 4

Allows the system to learn unknown IP addresses with the option to add each as a data source

Question 5

How can you manually retrieve Events and Flows on ESM?

Answer 5

• Clic the ESM component of interest like ERC, ACE, ADM or DEM
• Clic on the Events and Flows Icon
• Check what you want to get (Event, Flows or both)
• Clic start

Question 6

What does the Asset Sources feature on ESM provide?

Answer 6

It allows to retrieve data from Active Directory