I have 2 questions:
1) I have read that ArcSight ESM can track a user's sessions . Is there a feature like that in Mcafee SIEM. My question is if it is possible to track all activities of a user on a report on a certain period of time.
2) Another question is that is it possible to track user's actions that is out of a baseline. Let's say that a user does certain activities and if user acts differently out of his baseline can Mcafee SIEM creates a notification?