I have an XG reporting that there is an ATP event. The address it is giving me is for the source is our Meraki AP. I do not think the Meraki is infected but more likely one of the clients connecting to that AP is.
The Meraki is Natting addresses, so…