By default, the McAfee SIEM performs automatic backups of the ESM configuration every 7 days. The default backup location resides on the ESM appliance. It is generally best practice to schedule data and log backups in addition to configuration backups to a secondary host storage platform. This ensures that a reliable restoration can be performed in the unfortunate event of a catastrophic failure of the ESM and that the backup files do not consume precious storage on the ESM.
To configure the ESM backup settings, follow these steps.
- From the ESM System Properties window, select the System Information menu option.
- Click Backup & Restore. The Backup & Restore window will open.
- Update the backup frequency (default every 7 days).
- Select Backup Data for Events and Event Logs.
- Select the radio button for Remote Location and provide the necessary CIFS/NFS location details including the remote IP address, share name, path, and credentials (CIFS only).
- Confirm the ESM can communicate to the remote location using the Test Connection button.