NDR is integrated with Trellix Logon Collector to monitor Active Directory domains and collects logon information. Trellix Logon Collector (Trellix LC or, TLC) polls Microsoft Active Directory domain controllers for user logon events and sends this information to security appliances to correlate network traffic with user behavior. Trellix Logon Collector is installed on separate Windows-based servers to communicate with the Active Directory, and supports distributed deployment. TLC deployment does not require any modification to the Active Directory or the Active Directory schema and requires no agents.
Why TLC-NDR integration is required
After integrating with TLC, NDR will enrich the events from Packet Capture, Network Security, and IPS with user information. Every event will have a user_info object present in it. The user_info object contains user details, such as the name, computer, domain and details whether the user is a privileged user or not.
Note
For more information on Trellix Logon Collector, see Trellix Logon Collector Administration Guide.
Sample user_info object is provided below:
"user_info": {"name": [“admin@piblr.qa"], "computer": ["FileServer2016.piblr.qa"], "domain": ["piblr.qa"], "privilegedAccount": "yes"}}Note
privilegedAccountfield inuser_infoobject is present only if the ad-sync feature is enabled in NDR.
Use the NDR CLI and configure TLC to continuously collect the latest logon information of your NDR appliance events.
Perform the following steps to configure TLC: