I'm getting concerned here. It used to be only 1 or 2 a week, but I've seen 3 alerts just today already! They are the "DC has been communicating with suspicious IP..." warnings.
Our ISP manages our firewall (unfortunately) because we have a MPLS with them, so I have to just submit a request for them to blacklist these IPs on our ACL. Sometimes it takes a day, sometimes a week for them to block the IPs. Is this just my users going to bad places on the net or what? What can I do to mitigate these threats?