We have an IPS in place and it's constantly triggering ICMP / Ping flood signatures between workstations and AD server; or AD to workstation. I understand that ICMP is used for AD authentication. However, the odd thing is that the count per event is quite high. Around 10,000 and above for one single event.
I constantly check on these workstations and AD; all seems to be fine. Nothing suspicious found and endpoint protection working fine.
What does the high count mean? Could it be false positive?