Display user details (Logon Collector data) in Attack log

If you have configured the Logon Collector you can view user details in the Attack Log page.

1. Navigate to Analysis → <Admin Domain Name> → Attack Log.
2. Double-click the alert for which you want to view the alert details.
   The alert details panel opens.
3. You can view the user details in the Attacker / Target section.

   
   
   

   The user details (Logon Collector data) are displayed in the Attack Log page only if the option to display is enabled in the ems.properties file. If it is not enabled, perform the following steps to enable the option.
   1. In the Manager, using Windows Explorer go to %programfiles%\Trellix\IPS Manager\App\config.
   2. Locate the ems.properties file, and right-click and open it using Windows Notepad.
   3. Ensure that the following values are configured (If the entries are not available, add the entries manually):
      iv.mlc.alert.preprocessor.enabled=true
      iv.mlc.alert.preprocessor.daemon.enabled=true