Display user details ( Logon Collector data) in Attack log

Steps:

1. Navigate to Analysis → <Admin Domain Name> → Attack Log.

2. Double-click the alert for which you want to view the alert details.

   The alert details panel opens.

3. You can view the user details in the Attacker / Target section.

   User details in Attack Log

   
   
   
   

   The user details (Logon Collector data) are displayed in the Attack Log page only if the option to display is enabled in the ems.properties file. If it is not enabled, perform the following steps to enable the option.

   1. In the Manager, locate the ems.properties file:

      • In Windows-based Manager, navigate to %programfiles%\Trellix\IPS Manager\App\config, and open the file using Notepad.

      • In Linux-based Manager, execute the edit ems.properties command to open the file on the Manager shell.

   2. Ensure that the following values are configured (If the entries are not available, add the entries manually):

      iv.mlc.alert.preprocessor.enabled=true

      iv.mlc.alert.preprocessor.daemon.enabled=true