Trellix DLP Network Prevent and Trellix DLP Network Monitor uses Trellix Logon Collector (MLC) servers to identify remote users when they make web requests. With Trellix Logon Collector, Trellix DLP Network can map an IP address to a Windows user name if no other authentication information is available.
With Trellix Logon Collector, remote users are identified through Security Identifiers (SIDs) instead of IP addresses, host names, or other user parameters that are subject to change.
For more information about Trellix Logon Collector, see the Trellix Logon Collector Administration Guide.
The certificate used between Trellix Logon Collector and Trellix DLP Network must be valid, or you can't add a Logon Collector server.
The remaining topics in this section discuss setting up Trellix Logon Collector with Trellix DLP Network in more detail.