question

AbdulrehmanbinAltaf avatar image
2 Votes"
AbdulrehmanbinAltaf asked AbdulrehmanbinAltaf answered

ATA ip address

Dear as we have on-prem ATA,
my question is why IP is not liked with the computer object and showing the PC details. as I'm aware of IP addresses have leasing and computer are getting different IP after a specific time but it needs to link.
when we search for an IP address. as you can see in the below screenshot, it is showing ie no details.
16747-01.jpg

as compared to computer object have full details
16748-02.jpg


ems-advanced-threat-analytics
02.jpg (242.7 KiB)
01.jpg (214.9 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

piaudonn avatar image
2 Votes"
piaudonn answered AbdulrehmanbinAltaf commented

Hard to tell with that amount of data... Let's see... When the domain controller received these Kerberos ticket requests, the ATA gateway (or light gateway) was not able to resolve the IP into an entity. It tried Reverse DNS, NetBIOS and NTLM over RPC and had no luck. So it stored those activities into a the profile of the Unresolved entity.

You might have the same IP used somewhere else at a different time. And for these communication, the gateway was able to do the resolution.

You can see the logs of the resolution attempts in the logs. See the following documentation to locate the Microsoft.Tri.Gateway-Resolution.log file.



· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

thanks for the response, its not about 1 ip address its about the behavior, all the ip addresses have same behavior.

0 Votes 0 ·
FahadNoaman-7438 avatar image
2 Votes"
FahadNoaman-7438 answered

Are these Ip's assigned to AOVPN, Direct access client or any other VPN client, if so then you need to check VPN console to know the hostname.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

AbdulrehmanbinAltaf avatar image
0 Votes"
AbdulrehmanbinAltaf answered

these are not the VPN client normal windows machine ie 10, server2019 etc

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.