specification: FinOps Framework
specificationVersion: '1.0'
schema: https://www.finops.org/framework/
alignedWith:
  framework: FinOps Foundation Framework
  frameworkUrl: https://www.finops.org/framework/
  dataSpec: FOCUS
  dataSpecVersion: '1.3'
  dataSpecUrl: https://focus.finops.org/focus-specification/v1-3/
provider: McAfee (Trellix)
providerId: mcafee
publisherName: Musarubra US LLC (Trellix) / McAfee, LLC
serviceCategory: Cybersecurity Software
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Antivirus
  - Cybersecurity
  - Endpoint Protection
  - Security
  - FinOps
  - FOCUS
description: 'FOCUS-aligned FinOps shape for McAfee / Trellix: per-seat / per-node enterprise license
  for the underlying security product, with API access bundled inside the product license rather than
  metered separately. Consumer McAfee is per-subscription seat licensing.'
notes: |
  No public per-API pricing. Cost is realized at the product license level (seats, nodes, EPS, throughput).
  FOCUS columns assume USD and the Trellix / Musarubra publisher entity for enterprise; consumer McAfee
  invoices come from McAfee LLC.
sources:
  - https://www.trellix.com/
  - https://www.mcafee.com/
principles:
  - name: Visibility
    description: Use the ePO console (on-prem) and the Trellix XDR / MVISION cloud console to observe
      seat / node consumption and license headroom; reconcile against the annual enterprise agreement
      true-up. Pull SIEM EPS metrics from the ESM dashboard.
  - name: Allocation
    description: Allocate by business unit and managed-endpoint group in ePO; tag policy assignments and
      device groups with cost-center metadata so chargeback aligns with the seat / node count actually
      consumed.
  - name: Optimization
    description: Reclaim seats from decommissioned endpoints during quarterly reviews, right-size SIEM
      EPS by tuning event filters and noisy log sources, and consolidate broker / proxy footprint to
      reduce VM / appliance count.
  - name: Accountability
    description: Assign a security-product owner per product line who reconciles the annual true-up
      against deployed counts and negotiates renewal with the channel partner.
domains:
  - name: Understand Usage and Cost
    capabilities:
      - Allocation
      - Reporting and Analytics
      - Anomaly Management
  - name: Quantify Business Value
    capabilities:
      - Planning and Estimating
      - Budgeting
      - Unit Economics
  - name: Optimize Usage and Cost
    capabilities:
      - Workload Optimization
      - Licensing and SaaS
  - name: Manage the FinOps Practice
    capabilities:
      - Invoicing and Chargeback
      - Onboarding Workloads
billingModel:
  pricingCategory: Per-Seat / Per-Node Subscription
  billingFrequency: Annual
  billingCurrency: USD
  chargeCategories:
    - Purchase
    - Adjustment
    - Credit
focusColumns:
  ServiceName: McAfee / Trellix Security Platform
  ServiceCategory: Cybersecurity Software
  ProviderName: McAfee / Trellix
  PublisherName: Musarubra US LLC (Trellix) / McAfee, LLC
  InvoiceIssuerName: Musarubra US LLC (Trellix) / McAfee, LLC
  BillingCurrency: USD
  ChargeCategory: Purchase
meters:
  - name: managed_endpoints
    description: Endpoints under management for ePO / Endpoint Security / XDR.
    unit: seat-year
    aggregation: max
    dimensions:
      - product
      - business_unit
      - environment
  - name: siem_eps
    description: Sustained events-per-second ingested into ESM SIEM.
    unit: events_per_second
    aggregation: max
    dimensions:
      - log_source
      - business_unit
  - name: web_gateway_users
    description: Users / throughput covered by Web Gateway license.
    unit: seat-year
    aggregation: max
    dimensions:
      - office
      - business_unit
  - name: dxl_broker_count
    description: Number of DXL brokers deployed to support fabric throughput.
    unit: instance
    aggregation: max
    dimensions:
      - region
      - environment
apis:
  - name: McAfee ePO API
    baseURL: https://your-epo-server:8443/remote
    tags:
      - Endpoint Management
      - Policy Orchestrator
      - Security Management
    serviceName: McAfee ePO API
    serviceCategory: API
  - name: McAfee MVISION API
    baseURL: https://api.mvision.mcafee.com
    tags:
      - Cloud Security
      - EDR
      - MVISION
      - Threat Detection
    serviceName: McAfee MVISION API
    serviceCategory: API
  - name: McAfee Threat Intelligence Exchange (TIE) API
    baseURL: https://your-tie-server/api
    tags:
      - Malware Analysis
      - Reputation
      - Threat Intelligence
    serviceName: McAfee Threat Intelligence Exchange (TIE) API
    serviceCategory: API
  - name: McAfee Data Exchange Layer (DXL) API
    baseURL: https://your-dxl-broker
    tags:
      - Data Exchange
      - Fabric
      - Integration
      - Messaging
    serviceName: McAfee Data Exchange Layer (DXL) API
    serviceCategory: API
  - name: McAfee Web Gateway API
    baseURL: https://your-mwg-server/Konfigurator/REST
    tags:
      - Proxy
      - Web Gateway
      - Web Security
    serviceName: McAfee Web Gateway API
    serviceCategory: API
  - name: McAfee ESM API
    baseURL: https://your-esm-server/rs/esm
    tags:
      - Log Management
      - Security Events
      - SIEM
    serviceName: McAfee ESM API
    serviceCategory: API
unitEconomics:
  - name: Cost per Managed Endpoint
    metric: billed_cost / managed_endpoints
  - name: Cost per EPS
    metric: siem_billed_cost / siem_eps
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com