The VMware vDefend Identity Firewall (IDFW) allows administrators to create distributed firewall rules based on Active Directory user identities rather than just IP addresses. To do this, vDefend must accurately map a user's login to a specific VM's IP address. It achieves this mapping through two primary supported logon detection methods:
Guest Introspection: An agent-based method utilizing VMware Tools installed on the guest OS to detect logons locally.
Event Log Scraping: An agentless method where vDefend integrates directly with Active Directory to scrape security event logs and track authentication events across the network.