Trellix Logon Collector can work with multiple domains and multiple forests. Each domain from which the Trellix Logon Collector receives security events must be added to the monitored domains of the Trellix Logon Collector.
You must have installed Trellix Logon Collector.
Select Menu → Configuration → Monitored Domains.
Click New Domain.
In the Domain Name tab, provide the credentials of the administrator user for the domain.
The domain name must be the complete domain name and not the NetBIOS name.
In the Domain Controller tab, select from the list of domain controllers from which Trellix Logon Collector fetches data for that domain.
Select the Logon Monitor to be used. This can be the localhost. For example, Trellix Logon Collector itself can be the Logon Monitor.
These steps must be repeated for each domain with which the Trellix Logon Collector is integrated.