Showing results for 
Search instead for 
Did you mean: 

SIEM GTI Integration


How GTI interface in ESM licensed? I mean if a customer asks to buy GTI in ESM what should we learn and what are the right question to ask to get the right licensing for the customer. How GTI in ESM licensed?


6 Replies
McAfee Employee siemchris
McAfee Employee
Report Inappropriate Content
Message 2 of 7

Re: SIEM GTI Integration


That question is best answered by you Sales Representative or Sales Engineer. If you do not have that information please let me know your contact information including location and I will get them to contact you.



Level 11
Report Inappropriate Content
Message 3 of 7

Re: SIEM GTI Integration

Hi, I found that GTI is licensed per 'nodes'.


A “Node” means any kind of device capable of processing data and includes any one of the following types of computer devices:

mobile/smart phone, diskless workstations, personal computer workstations, networked computer workstations,

homeworker/teleworker home-based systems, file and print servers, e-mail servers, Internet gateway devices, storage area

network servers (SANS), terminal servers, or portable workstations connected or connecting to the server(s) or network. For

purposes of further clarification, a blade server is defined as a single blade computing system inserted into a blade chassis. In

the case of a virtual system, a hypervisor is considered to be a single node.

So - as I understand, you should to count all devices on the customer's network, however (I am not 100% sure) maybe in this case you should to count only the devices that are "data sources". So - as Chris told before - we should to ask about this our SE or SR.


Artur Sadownik

Re: SIEM GTI Integration

Thank you. That is the only way I think of to license it  as "per nodes" I will talk with my sales Rep about it. Thanks for all replies

Level 11
Report Inappropriate Content
Message 5 of 7

Re: SIEM GTI Integration


you should to count all devices with IP address behind your firewall:

“LicensedPer Live Host, McAfee Global Threat Intelligence Enterprise Security ManagerModule is protecting the IPs behind

the firewall.”




Re: SIEM GTI Integration

What Artur said is correct information according to what I know. That's why last year, minimum license for GTI is 10,000 nodes.



Re: SIEM GTI Integration

Thanks for all comments

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator