Unknown traffic generate on NPM NTA with virus threat

mistik84

Hi Team,

i am facing some issue with network team mentioning that there are some traffic is trying to go outside to internet from Orion Server.

and below i attach the image capture and the result from antivirus server. is there are some threat or false alarm will be trigger from NTA module?

please help.

thanks alot!!

Our scanning found below activity.

-Log Details-

Protection Event Date: 6/5/18

Protection Event Time: 3:18 PM

Log File: 9ef4d6c7-6890-11e8-b649-0050568e4ae2.json

Administrator: Yes

-Software Information-

Version: 3.5.1.2522

Components Version: 1.0.365

Update Package Version: 1.0.5362

License: Trial

-System Information-

OS: Windows Server 2012 R2

CPU: x64

File System: NTFS

User: System

-Blocked Website Details-

Malicious Website: 1

, , Blocked, [-1], [-1],0.0.0

-Website Data-

Category: RiskWare

Domain:

IP Address: 197.149.90.154

Port: [137]

Type: Outbound

File: \Program Files (x86)\SolarWinds\Orion\NetFlowTrafficAnalysis\NetFlowService.exe

mesverrum

It would seem that your NTA is doing netbios lookups for an address that it saw in the environment.  I looked up that address and it is a Mikrotik router, those were recently known to be compromised as part of a bot net so i wouldn't be surprised that it is probing your environment and NTA is trying to look up a name for it. You can disable netbios lookups in the NTA settings if you prefer.