I installed the ATA light gateway on 4 DCs. I successfully setup the smtp server for notifications and added my email address to receive health and suspicious activity alerts. I can search for any users in the ata center and see their recent activities.
However, I don't see any reporting of suspicious activities in ATA center. I ran the nslookup ls -d domain command twice and it generated two ata suspicious alerts but when my coworkers ran the same command ata didn't report any suspicious activity for
them. Any idea? your help would be greatly appreciated.
Yes, those 4 DCs cover our entire network and my co workers are hitting the same DCs. I ran the nslookup ls -d domain a few more times again but they didn't generate anymore ATA alerts.
My coworkers are attacking from their own desktop PCs and none of those machines are DNS servers. The ATA server is also not a DNS server. I hope it answers your questions since I'm not sure what you mean by source machines.
