This question has been asked multiple times in this forum, but there are no answers.
ATA is giving us indications that there are brute force attacks on several accounts. We have received this notification several times over the last few weeks.
In all cases, when we try to research where these attacks are coming from, we find that there is NO correlating information on our domain to track down these "attacks".
When I parse our domain security event log, there are no login attempts, there is no other information to show where these attacks are coming from.
