7 Replies Latest reply on Sep 6, 2016 4:55 PM by andy777

    McAfee SIEM components communication

    aygitci

      Hi,

       

      In this classic McAfee SIEM architecture, can someone confirm the flows between components (standalone) when handling an event :

       

       

      In the picture above, I have doubts regarding the order of the sequence when a log/event is received and parsed by the ERC.

       

      The next steps is not clear :

           - the event is stored in ELM -> sent to ESM -> Correlated by ACE ?

      or

           - the event is stored in ELM -> sent to ACE for correlation -> sent to ESM ?

       

      and

       

           - is the event non-parsed sent to ELM for storage or for other purpose ? or this step doesn't exist ?

       

           - when an alarm is triggered by the ESM, this one is stored in the ESM or the ELM ?

       

       

      Thanks very much

      Regards

       

      AyGitci

        • 1. Re: McAfee SIEM components communication
          LT McGary

          Hi Ay,

           

          The steps are as follows:

           

          1. Raw log events are sent to the receiver from the data sources
          2. The raw logs are sent directly to the ELM from the receiver
            1. Parsed event are sent to the ESM
          3. The ESM send these parsed events to the ACE for Correlation

           

          See my diagram below:

           

          SIEM Architecture.PNG

          2 of 2 people found this helpful
          • 2. Re: McAfee SIEM components communication
            Sailendra Pamidi

            Hello,

             

            Thank you for your answer. On the workflow for the Parsed events, once the events are collected by the collector process and parsed by the parser process, the parsed events are inserted into the Receiver's database.  Based on the polling interval (10 mins) by default, the ESM will retrieve the events and flows by querying the Receiver database and then inserts them into the database running on the ESM.

             

            Thank you.

            1 of 1 people found this helpful
            • 3. Re: McAfee SIEM components communication
              itzamlan

              but there is connection in between the ELM and ESM also, while querying ELM search information from the ESM.

              • 4. Re: McAfee SIEM components communication
                kmc

                One more thing the ESM will pull events from receiver and receiver never pushes the events to ESM, additionally the ESM will push events to the correlation even though it's hosted on the Receiver.

                 

                itzamlan yes there is AES encrypted connection between ESM and ELM as well.

                 

                Regards,

                KMC

                • 5. Re: McAfee SIEM components communication
                  itzamlan

                  kmc how does the parsing happens while pulling logs from ELM? As ELM contains the raw logs. Or is it like the ELM contains the raw logs as well as the parsed logs, serving as a kind of backup/repository to the ESM?

                  • 6. Re: McAfee SIEM components communication
                    kmc

                    I believe parsing is not happens ween you pulling/Searching logs from ELM.

                    ELMs collect and store raw logs for compliance purposes and raw log search only. ELMs can also perform full text indexing of stored logs. ELMs also provide a forensically sound audit trail of logs and its actually optional for the overall system.

                    • 7. Re: McAfee SIEM components communication
                      andy777

                      how does the parsing happens while pulling logs from ELM? As ELM contains the raw logs. Or is it like the ELM contains the raw logs as well as the parsed logs, serving as a kind of backup/repository to the ESM?

                       

                      There are essentially two copies of the data. The ESM holds the parsed and aggregated version of the original logs stored on the ELM. The ESM database has records and record-ID can represent many aggregated events. The records are tied to the events they represent in the ELM which allows for the "ELM Archive" tab to go and pull the relevant events when you are looking at an aggregated event in the ESM. The chief purpose of the ELM is to meet various compliance standards that mandate the long term storage of original logs for some period of time.

                       

                      I think the solution will see expanded logging functionality in a future release. Thanks.