Showing results for 
Search instead for 
Did you mean: 

SIEM GTI Integration


How GTI interface in ESM licensed? I mean if a customer asks to buy GTI in ESM what should we learn and what are the right question to ask to get the right licensing for the customer. How GTI in ESM licensed?


6 Replies
McAfee Employee siemchris
McAfee Employee
Report Inappropriate Content
Message 2 of 7

Re: SIEM GTI Integration


That question is best answered by you Sales Representative or Sales Engineer. If you do not have that information please let me know your contact information including location and I will get them to contact you.



Level 11
Report Inappropriate Content
Message 3 of 7

Re: SIEM GTI Integration

Hi, I found that GTI is licensed per 'nodes'.


A “Node” means any kind of device capable of processing data and includes any one of the following types of computer devices:

mobile/smart phone, diskless workstations, personal computer workstations, networked computer workstations,

homeworker/teleworker home-based systems, file and print servers, e-mail servers, Internet gateway devices, storage area

network servers (SANS), terminal servers, or portable workstations connected or connecting to the server(s) or network. For

purposes of further clarification, a blade server is defined as a single blade computing system inserted into a blade chassis. In

the case of a virtual system, a hypervisor is considered to be a single node.

So - as I understand, you should to count all devices on the customer's network, however (I am not 100% sure) maybe in this case you should to count only the devices that are "data sources". So - as Chris told before - we should to ask about this our SE or SR.


Artur Sadownik

Re: SIEM GTI Integration

Thank you. That is the only way I think of to license it  as "per nodes" I will talk with my sales Rep about it. Thanks for all replies

Level 11
Report Inappropriate Content
Message 5 of 7

Re: SIEM GTI Integration


you should to count all devices with IP address behind your firewall:

“LicensedPer Live Host, McAfee Global Threat Intelligence Enterprise Security ManagerModule is protecting the IPs behind

the firewall.”




Re: SIEM GTI Integration

What Artur said is correct information according to what I know. That's why last year, minimum license for GTI is 10,000 nodes.



Re: SIEM GTI Integration

Thanks for all comments

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community