The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Backfill Events

  • Published on Sep 11, 2026
  • 1 minute(s) read
Prev Next
Skip to main content

When Logon Tracker first runs on an endpoint, it can parse existing logs to identify the logon history for that endpoint. Backfill is enabled by default.

Note

Disabling backfill is not recommended.

Capturing historical logon activity is critical to investigating lateral movement.

Related articles
  • Investigate malicious authentication patterns with Logon Tracker
    Endpoint Detection and Response with Forensics (EDRF) > Investigate potential threats with EDRF > Analyzing forensic data > Analyze forensic data using HX modules > Investigate malicious authentication patterns with Logon Tracker
  • Backfill events
    Endpoint Security Modules (HX) > Logon Tracker > Endpoint Security Logon Tracker Module User Guide Release 1.2.0 > Configuring Logon Tracker > Configuring Logon Tracker agent policy
  • Linux Events
    Endpoint Security Modules (HX) > Logon Tracker > Endpoint Security Logon Tracker Module User Guide Release 1.1.9 > Module Overview > Logon Data Sources