(imported topic written by BionicSecurityEngineer91)
I’m evaluating ESP 7.2 and CPM 1.5 as a replacement for McAfee EPO 4.0 and VirusScan Enterprise 8.7i (abbreviated to VSE in this thread), and I am running into some feature issues that I’d like to get feedback on from existing ESP & CPM admins.
- End User Notification (to notify or not to notify)
CPM has the client-side UI dashboard, but lacks real-time threat notification (I’m new to CPM, so if you know a way to send an alert to the user…please send me a link or message).
I’m concerned the lack of an end user alert will hurt the user experience. Our computers operating VSE display a pop-up message with threat name and action taken to the end user anytime a threat is detected. My concern is that a user will not be aware that CPM has taken an action and continue working (potentially in a compromised state) without realizing they have “stepped on a land mine”. Right now users call the service desk for support if the McAfee VSE On-Access Scanner detects a threat and it’s not removed or cleaned, which helps us control the spread of threats.
Q. What’s the opinion on alerting the end user? Good / Bad / Indifferent?
Q. Has anyone moved from McAfee VSE to Trend CPM and found this to be an issue? If so, do you mind sharing your solution?
- SNMP Alerting
Again, I’m being told that ESP and CPM both lack support for sending SNMP traps. Our McAfee ePolicy Orchestrator (EPO) console is configured to send a trap to our Security Incident Event Management platform for each virus alert, so our security team can perform event correlation and track the spread of infection. At this point I’m being told that my only alert option is to configure Trend ESP to send an email when “actions” are taken by CPM clients, but I find this option extremely limited and dependent to the email system working, which in a virus outbreak could be swamped with higher than expected mail traffic. I’m shocked that Trend ESP and CPM lack the traditional alerting capabilities that other vendors offer as standard features.
Q. Is this a common opinion by CPM/ESP admins?
Q. Has anyone figured out how to incorporate SNMP into the Trend ESP/CPM lineup, either by using a script called by an action (triggered by a threat detection) or through an addon product? I did see this post, http://forum.bigfix.com/viewtopic.php?pid=13884, and it mentions setting up reporting with traps, so I’m hopeful snmp may be viable.
- Real Time Scan Monitoring
Again, CPM lacks a UI to monitor real-time scanning on a host, whereas McAfee VSE can be monitored remotely or locally to determine which files/folders are being inspected by the scanner, which aids us in the diagnoses of host and application slow downs. Our biggest problem with VSE is when the On-Access Scanner locks up scanning a file or folder on a high I/O host, and the result is the host usually hangs and requires a power reset to resolve, so we’re concerned the lack of monitor will hamper our troubleshooting efforts.
Q. Has anyone figured out how to perform real-time monitor CPM? I could use procmon.exe to monitor how much time the CPM process spends scanning a file, but this would be an intensive and undesirable process.
Last, I’m looking for any other performance, functionality, and reporting feedback from admins who have previously switched from McAfee VSE to Trend CPM
Q. How did your migration go?
Q. What lessons did you learn?
Q. What pitfalls did you discover?
Q. What was the sales to operations transition like?