The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Alerting on account usage and system access

  • Published on Sep 11, 2026
  • 1 minute(s) read
Prev Next
Skip to main content

It is not uncommon for an attacker to return to a compromised environment throughout the course of an investigation (for example, while the security team is preparing the remediation event). During this time, it may be desirable to setup alerting rules for the use of compromised accounts, logons to or from compromised systems, or logons originating from attacker infrastructure.

See the “Alerting Rules” section for information on how to configure Logon Tracker to produce Endpoint alerts.

Related articles
  • Alerting on account usage and system access
    Endpoint Security Modules (HX) > Logon Tracker > Endpoint Security Logon Tracker Module User Guide Release 1.2.0 > Common investigative workflows > Investigating known bad accounts or systems
  • Alerting on account usage and system access
    Endpoint Security Modules (HX) > Logon Tracker > Endpoint Security (HX) Logon Tracker Module User Guide 1.3.x > Common investigative workflows > Investigating known bad accounts or systems
  • Alerting Rules
    Endpoint Security Modules (HX) > Logon Tracker > Endpoint Security Logon Tracker Module User Guide Release 1.1.9 > The Logon Tracker Module Home Page