Each time a user logs on to the network or requires access to any domain-controlled resource, the domain controller creates an event log entry in the Security Event Log file. This log file is available to remote systems such as the Logon Collector and the Logon Monitor using WMI.
Trellix Logon Collector is configured to relay user information to the managed products, based on log events from domain controllers and exchange server. However, the domain controller might not include accurate user logs for some scenarios. Some of the scenarios such as these:
User logs on to the workstation that uses cached credentials
In WLAN, the information about user name and IP address mapping is available from WLAN controller. Similarly, in Virtual Private Network (VPN), the information about user name and IP address mapping is available in the VPN gateway logs. The domain controller creates an event log entry of the user from these access points but this might not be an accurate user data.
In these scenarios, the Logon Collector does not get these user log details through the WMI. So, it is required to use RESTful APIs and send these data to the Logon Collector server. REST stands for Representational State Transfer. REST client use HTTP requests to post (create), get (query information) and delete data in the Logon Collector. It connects to the Logon Collector server on port 8444.
Note
Domains should be added to Trellix Logon Collector for APIs to be used for sending or retrieving user logons for domains that are monitored by Trellix Logon Collector.
In addition to the data which the Logon Collector directly collects from the domain controller, the data that is updated using RESTful API is also made available to managed products.
In the High Availability mode, all data that are created or deleted using the RESTful API requests in the primary Trellix Logon Collector (TLC) server are replicated in the secondary TLC server. When the primary TLC server goes down, the secondary TLC server becomes active and updates data by RESTful API requests.
Note
RESTful API requests cannot be made to a passive secondary TLC server.
When the primary TLC server comes up again after a certain time, it receives the replicated data from the active secondary TLC server.
Authentication is needed to access the APIs. The following are the RESTful APIs used in Trellix Logon Collector.
Login API
Logout API
ListAllLogins API
GetLoginFor User API
GetLoginForComputer API
GetLoginForIPAddress API
The following sections explain about these APIs with more details.