Trellix Logon Collector is a Microsoft Windows-based distributed collector. It is an independent service installed in a network, which obtains and preprocesses the network entities data from the Active Directories in the network. The data include users, IP to user bindings, computer groups, new IP addresses, and new computers. This information is published in the form of messages.
This solution does not require any modification to Active Directory or the Active Directory directory schema and requires no agents.
Logon Monitors can be used to poll nearby domain controllers and forward collected information on to the Logon Collector, shortening the distance domain controller communication must travel.
Identity Acquisition Agent (IAA), is deployed on the Trellix IPS side and is used as an interface to listen to the message service where the updates are published by the Trellix Logon Collector (TLC) server. IAA listens to the Logon Collector Active Message Queue (MQ) service and regularly receives new updates from the TLC server.
A listener for receiving the updates is registered with the IAA. The registered listener regularly receives new updates from the Logon Collector through IAA.
All IP to user bindings data are loaded into a newly created Manager cache for the first time. The cache is subsequently updated with the differences on subsequent updates. As all the other components of the Manager can query the Manager cache, it is not required to communicate with the TLC server each time an update happens.
.png "GUID-91472C55-1B71-488F-9FF3-73D026EA7976-low.png")