Using external authentication servers

Trellix DLP Network - SaaS can work with registered Active Directory servers and Trellix Logon Collector to retrieve user information and logon data. The data helps identify users responsible for data loss incidents using their name, group, department, city, or country.

Trellix DLP Network - SaaS can:

Trellix Logon Collector records Windows user logon events and communicates the information to Trellix DLP Network - SaaS . Trellix DLP Network - SaaS can map an IP address to a Windows user name if no other authentication information is available.

What happens if the Active Directory server is unavailable?

Trellix DLP Network - SaaS caches LDAP information. The cache updates every 24 hours, so temporary unavailability of the Active Directory server does not affect Trellix DLP Network - SaaS service availability. If the cache update fails, Trellix DLP Network - SaaS uses the previous cache. If a previous cache is not available, it performs an LDAP lookup to get the information.

Note

If Trellix DLP Network - SaaS can't reach or communicate with a newly configured Active Directory server, the domain-based lookup fails. Policy push also fails if you have configured domain-based users or groups in policies and not selected the corresponding Active Directory server for the appliance.

When Trellix DLP Network Prevent – SaaS needs LDAP group information to evaluate rules for a request or message, and LDAP is not configured or the server is unavailable:

For Trellix DLP Network Monitor – SaaS, if Trellix Logon Collector or the LDAP information is unavailable, rules which refer to user and group information can't be matched and incidents are not created. Your traffic flow is unaffected.

Active Directory servers

Additional web protection authentication

When applying web protection rules, Trellix DLP Network Prevent – SaaS can get user information from:

If a user name is supplied in the X-Authenticated-User ICAP header, it is used in preference to data from Trellix Logon Collector.

Tip

Using the X-Authenticated-User header is the recommended authentication method because it indicates that the web gateway has positively authenticated the user. To set it up, you must perform some additional configuration on the web gateway. For more information, see your web gateway product documentation.

If the X-Authenticated-User header is not available, you can configure Trellix Logon Collector to provide additional authentication. Trellix Logon Collector is another Trellix product that monitors Windows logon events and maps an IP address to a Security Identifier (SID). To use Trellix Logon Collector, you must have at least one Active Directory server configured. Trellix DLP Network - SaaS can query it to convert a SID to a user name.

When applying email or web protection rules, Trellix DLP Network Prevent – SaaS evaluates group information from the user information. It ignores any X-Authenticated-Groups header value from the web gateway.

To select rules based on users and groups for Trellix DLP Network Monitor – SaaS, you must configure Trellix Logon Collector.

Important

To obtain user or group information, you must have at least one Active Directory server configured. The Trellix DLP Network - SaaS appliance queries Active Directory servers to get the required attributes. For example, for Trellix Logon Collector, the Trellix DLP – SaaS appliance uses the Active Directory server to convert the SID to a user DN.

Supported authentication schemes

The Trellix DLP Network Prevent – SaaS appliance supports the WINNT, NTLM, KERBEROS, LOCAL, and LDAP authentication schemes to process the X-Authenticated-User header from the web gateway.

The Trellix DLP Network Prevent – SaaS appliance expects the format for the X-Authenticated-User header to be in one of these formats for Active Directory:

With LDAP, Trellix DLP Network Prevent – SaaS expects the X-Authenticated-User header to be in the format LDAP://<LDAP_servername/distinguished-name> for Active Directory.

Note

Trellix DLP Network Prevent – SaaS uses the distinguished-name LDAP attribute to retrieve user details for web protection rules. Verify that your Active Directory server exposes this attribute to make sure that the LDAP authentication scheme works correctly.

Use case

You want to configure a web protection rule that blocks uploads of PCI data for all users in a department apart from one.