I did review that article before posting here, but thanks for including the link; I believe my question is about this part of the article:
The ExtraHop system creates a device entry for every local MAC address discovered over the wire. IP addresses are mapped to the MAC address, but metrics are stored with the device MAC address even if the IP address changes.
How are IP addresses mapped to MAC addresses of devices? Is the process different depending on whether the device is using DHCP or has a statically assigned IP? I ask because the answer to your question:
is that ExtraHop did not associate the IP address with the domain controller to which it is statically assigned, at the date and time it generated the DCSync detection.
Given a DCSync detection with offender IP address
A and domain controller victim
bar as another domain controller in the same domain as
bar are devices in ExtraHop.
ExtraHop should not have generated the DCSync detection because
A is the static IP address assigned to
bar, but ExtraHop…for whatever reason…did not have associated
bar, and generated the detection.
I hope the above makes sense and clarifies my ask. I posted here first as I already have a number of open support cases and want to weed out user error/inexperience before opening a new one.