Trellix Logon Collector communicates Windows user logon events to Trellix DLP Network - SaaS appliances. Trellix DLP Network - SaaS appliances can map an IP address to a Windows user name if no other authentication information is available.
When a user logs on to the network, the domain controller creates an event in the security event log.
This is a special, protected log file that can be accessed using the Windows Management Interface (WMI). Trellix Logon Collector uses this interface to receive log-on events and stores a mapping of the user’s device IP to the user data.
When Trellix Logon Collector integrates with Trellix DLP – SaaS appliances, the appliances synchronize the client IP and the user’s SID from Trellix Logon Collector on to a local cache available on each appliance.