Trellix DLP Network Prevent – SaaS and Trellix DLP Network Monitor – SaaS uses Trellix Logon Collector servers to identify remote users when they make web requests. With Trellix Logon Collector, Trellix DLP – SaaS appliances can map an IP address to a Windows user name if no other authentication information is available.
With Trellix Logon Collector, remote users are identified through Security Identifiers (SIDs) instead of IP addresses, host names, or other user parameters that are subject to change.
For more information about Trellix Logon Collector, see the Trellix Logon Collector Administration Guide.
The certificate used between Trellix Logon Collector and Trellix DLP – SaaS appliances must be valid, or you can't add a Logon Collector server.
Follow these topics to learn more about setting up Trellix Logon Collector with Trellix DLP – SaaS appliances: