AAA Concepts

Prev Next

AAA (authentication, authorization, and accounting) is a security framework that validates user identities, enforces access to resources, and audits user activities and usage.

  • Authentication validates users before they are allowed to access the system. Each user has a unique identity and associated credentials. The authentication process compares the login credentials the user provides with the user credentials stored in a database. If the credentials match, the user is granted access to the system; otherwise, the authentication fails and the user is denied access.

  • Authorization provides access control. You configure authorization by assigning users roles, which offer a specific set of capabilities on the appliance. You can also configure access groups on a Central Management System appliance, which controls which alerts users with the analyst and monitor roles can view and manage.

  • Accounting tracks user activities and resource usage.

Important

The default admin account in Trellix appliances is a system-reserved identifier that cannot be renamed, nor does it support Multi-Factor Authentication (MFA) enforcement. For enhanced security, you should use this account only for initial configuration and create unique, MFA-enabled administrative users for daily operations.