New features

Added functionality for this release:

Consolidated data source configuration reference

Find current information about how to configure data sources for McAfee ESM in the new Data Sources Configuration Reference. This new reference consolidates content for more than 175 data sources in one place.

Redundant ESM improved syncing

Redundant ESMs (System ProptertiesESM ManagementRedundancy) now sync much more efficiently. Syncing requires no down time and has minimal performance impact. The initial sync may take longer than the previous sync method, but subsequent syncs will be much faster.

ELS Search Syntax

A new search syntax adds flexibility to ELS searches.



Returns items that contain both terms.





john doe

john and doe

john AND doe

john & Doe


Returns items that contain either term.




john or doe

john OR doe

john | doe


Excludes terms from results. Must be used with AND.




john and not doe

john and NOT doe

john and !doe

john and ! doe


Returns items that contain a specific term. Quotation marks must be used in pairs and search terms cannot contain spaces.




Nested search terms help narrow search results. Terms contained in parentheses are processed first.


(john and doe) or smith

(john) and (doe or smith)

john (doe | smith)

(john | jane)(doe | smith)


Wild cards return terms that contain, start with, or end with a specific term.


*abcd* - contains

abcd* - starts with

*abcd - ends with