Trellix Logon Collector is a software that monitors Active Directory domains and collects logon information. Trellix Logon Collector (Trellix - LC or, TLC) polls Microsoft Active Directory domain controllers for user logon events and sends this information to security appliances to correlate network traffic with user behavior. Trellix Logon Collector is installed on separate Windows-based servers to communicate with the Active Directory, and supports distributed deployment. TLC deployment does not require any modification to the Active Directory or the Active Directory schema and requires no agents.
Logon Monitors can be used to poll nearby domain controllers and forward collected information to the Logon Collector, shortening the distance domain controller communication must travel.
Trellix Logon Collector 3.0 RESTful API Reference Guide 3
2 | Introduction to Trellix Logon Collector