Create the SIEM account to integrate Active Directory (AD) SIEM with Trellix EDR.
Make sure the account names are case sensitive.
Make sure you do not use a service account because it is not supported with the current implementation of the LDAP query.
Create the Active Directory account.
Add the account to the SIEM administration group.
Log on to SIEM using the new account.
If the logon is successful, continue to the next step. Else:
Log on back into the SIEM using NGCP.
Note
For information about recovering the lost NGCP password, see KB74811.
Log off from the SIEM account.
Find the newly created user account under Users on the Trellix ESM, click edit, and select administrator checkbox.
Click Save.