SIEM Collector in a workgroup can't collect Windows events from a Windows host located in a remote domain
Last Modified: 2022-11-15 09:00:48 Etc/GMT
Affected Products
Languages:
This article is available in the following languages:
Trellix CEO, Bryan Palma, explains the critical need for security that’s always learning.
As per Gartner, "XDR is an emerging technology that can offer improved threat prevention, detection and response."
Trellix announced the establishment of the Trellix Advanced Research Center to advance global threat intelligence.
Trellix Advanced Research Center analyzes threat data on ransomware, nation-states, sectors, vectors, LotL, MITRE ATT&CK techniques, and emails.
As of May 14, 2024, Knowledge Base (KB) articles will only be published and updated in our new Trellix Thrive Knowledge space.
Log in to the Thrive Portal using your OKTA credentials and start searching the new space. Legacy KB IDs are indexed and you will be able to find them easily just by typing the legacy KB ID.
SIEM Collector in a workgroup can't collect Windows events from a Windows host located in a remote domain
Technical Articles ID:
KB91383
Last Modified: 2022-11-15 09:00:48 Etc/GMT Environment
SIEM Enterprise Security Manager 11.x SIEM Event Receiver 11.x SIEM Collector Agent 11.x Problem
You want to collect Windows events from a host located in a remote domain, but you can't connect to the host to collect these events. Adding the client to collect the Windows events displays the error below: NOTE: X.X.X.X is the IP address of the host located in the remote domain. Validation might also fail for the clients, when you click Validate. You then see the message below: Cause
SIEM Collector v11 uses a process called impersonation for connections to remote hosts. The Collector tries to authenticate credentials using the host that it's running on. In a domain, the local device knows to forward such requests to the domain controller to validate.
Solution
This feature isn't supported in SIEM Collector v11. The security module and the way we handle authentication and remote connections has changed in SIEM Collector v11. Losing arbitrary domain connection is a consequence of this change. To submit a new product idea, go to the Enterprise Customer Product Ideas page.
Click Sign In and enter your ServicePortal User ID and password. If you do not yet have a ServicePortal or Community account, click Register to register for a new account on either website. For more information about product ideas, see KB60021 - How to submit a Product Idea. Workaround
To work around this problem, perform either of the following:
Affected ProductsLanguages:This article is available in the following languages: |
|