Trellix Logon Collector (MLC) communicates Windows user logon events to Trellix DLP Network. Trellix DLP Network can map an IP address to a Windows user name if no other authentication information is available.
.png)
When a user logs on to the network, the domain controller creates an event in the security event log.
This is a special, protected log file that can be accessed using the Windows Management Interface (WMI). Trellix Logon Collector uses this interface to receive log-on events and stores a mapping of the user’s device IP to the user data.
When Trellix Logon Collector integrates with Trellix DLP Network systems, the systems synchronize the client IP and the user’s SID from Trellix Logon Collector on to a local cache available on each system.