09-15-2022 12:35 PM
Ok, so the user was not behind NAT, but school Campus with /20 subnet.
Can anyone explain me, why cortex says the SRC_HOSTNAME = MSTSC.EXE? Does it makes sence?
Probably the FW is not switch to the public, so we will have to investigate the GPO.