FAQs for SIEM Content Packs

Technical Articles ID: KB84036
Last Modified: 10/20/2021

Environment

McAfee SIEM Enterprise Security Manager (ESM) 11.x.x
McAfee SIEM Advanced Correlation Engine (ACE) 11.x.x
McAfee SIEM Event Receiver (Receiver) 11.x.x

Summary

This article is a consolidated list of common questions and answers. It is intended for users who are new to the product, but can be of use to all users.

Recent updates to this article

Date	Update
October 20, 2021	Updated categories to reflect latest code build release.
March 26, 2021	Updated categories and removed EOL versions.
August 13, 2019	Updated content, Environment, and Categories. Removed EOL versions.
December 3, 2018	Updated Environment and Categories. Removed version 9.5.x information.
March 7, 2018	Added Recent Updates table.

What are Content Packs?

Enterprise Security Manager (ESM) allows you to simplify operations with “ready to go” security use-case oriented Content Packs, created by McAfee Enterprise.

Through the automated content bundles, you can select, download, and deploy critical SIEM configuration settings that are focused on monitoring use cases. Cases monitored include insider threat, data leakage, email content, firewall, malicious activity, malware, policy, reconnaissance, suspicious activity, web filtering, and authentication. The Content Packs are preconfigured to offer you fast access to advanced threat or compliance-management capabilities.

Content Packs can contain predefined ESM Views, Reports, Watchlists, Alarms, Correlation Rules, and Variables. You can browse through them and select only the content that you require.

How are Content Packs created and distributed?

McAfee Enterprise experts collaborate with partners and customers to create the Content Packs. After development and testing, Content Packs are hosted on the McAfee SIEM Rules Server. No additional network or firewall configurations are needed to review and download Content Packs. In addition, Content Packs are also available for download from the Knowledge Base.

Which ESM versions are compatible with Content Packs?

Content Packs are currently compatible with all supported versions of ESM. Most Content Packs consist of one .zip file which can be used on all ESM versions. Some Content Packs consist of two .zip files (one for an older and one for newer ESM versions). The Content Pack documentation contains information regarding which .zip file is to be used for your ESM installation.

How often are new Content Packs created? Can I review which packages are available?

Content Packs are released as often as needed and in response to prioritized use cases.

For a full catalog of available Content Packs, see the McAfee Content Catalog.

You can browse, update, install, or uninstall Content Packs anytime from inside the ESM User Interface by clicking System Properties. You can review details of the Content Packs before installation. Items that can be reviewed are targeted use case, applicable device types, requirements, correlation rules, reports, watchlists, alarms, and variable names.

How do I find Content Packs in the Knowledge Base?
To help our customers implement Content Packs, McAfee adds individual articles to the Knowledge Base for each Content Pack that we provide. These articles contain the Content Pack in a .zip attachment, together with detailed use information in PDF form.

New Content Pack articles are added regularly. View the current list of Content Pack articles or follow the steps below to perform a manual search for the Content Pack articles:

Go to the McAfee Enterprise Knowledge Center.
On the Knowledge Center tab of the ServicePortal, type SIEM Content Pack in the Search Term field, and in the Match drop-down list, select Exactly.
In the Product field, select SIEM - All Products.
Click Search.

NOTE: The SIEM Content Pack articles are available only to registered ServicePortal users. Log on to the ServicePortal to access them.

Who can receive Content Packs?

Content Packs are offered to all ESM customers, and are included in their annual maintenance contract. There are no additional costs.

Affected Products

Getting Started
SIEM Advanced Correlation Engine 11.5.x
SIEM Advanced Correlation Engine 11.4.x
SIEM Advanced Correlation Engine 11.3.x
SIEM Advanced Correlation Engine 11.2.x (EOL)
SIEM Advanced Correlation Engine 11.1.x (EOL)
SIEM Enterprise Security Manager 11.5.x
SIEM Enterprise Security Manager 11.4.x
SIEM Enterprise Security Manager 11.3.x
SIEM Enterprise Security Manager 11.2.x (EOL)
SIEM Enterprise Security Manager 11.1.x (EOL)
SIEM Event Receiver 11.5.x
SIEM Event Receiver 11.4.x
SIEM Event Receiver 11.3.x
SIEM Event Receiver 11.2.x (EOL)
SIEM Event Receiver 11.1.x (EOL)

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Knowledge Center

FAQs for SIEM Content Packs

Environment

Summary

Affected Products

Languages:

Title

Title

Knowledge Center

FAQs for SIEM Content Packs

Environment

Summary

Affected Products

Languages:

Choose your region

Title

Title