Hello, I was wondering if anyone else had the same issue of getting alerts that are caused by scheduled internal vulnerability scans and more importantly, how it was dealt with. For instance, we would receive alerts on <g class="gr_ gr_404
gr-alert gr_gramm gr_inline_cards gr_run_anim Grammar only-ins doubleReplace replaceWithoutSep" data-gr-id="404" id="404">enumeration</g> of domain users against DCs from the machines that are being scanned by the internal
scanner. ATA, however, would see the activity as the remote machines enumerating and not necessarily catching the scanner doing it behind the scanned machines.
While I do realize that there are alert exclusions but it really should be a last resort as it is degrading the ATA capabilities in the first place.
Thank you.
