I have limited logs for this event but the IPS says its a NBTstat query outbound over UDP port 137 to a Microsoft owned IP address.
Should UDP 137 ever reach out externally?
This is about all the information I have as its very limited access to the client.
