I received notification from our info security team that there was an attempted SSH drop from one of our OpManager probe servers to an external IP address. It hasn't happened since which is a cause for alarm (if it happened more than once, we would imagine it was a scheduled job or something).

Can you please advise what could be initiating this connection, i.e. what feature I need to look at in OpManager that could send these SSH drops?

Thanks in advance.

Regards,

Mat