Finding the ' True' source - FTP client

[Anonymous4]

Hi.. New to the forum ! I need some help please.. On the FortiAnalyzer Report I have a FTP attack with a source and destination IP address. I have checked both IP servers and the software in the description of the attack information is not found on either server, in fact NO FTP software is installed on either. So am I correct in saying that the FTP client can be anywhere on the network and merely instructing data to be copied from one server to another? and that the data doesn' t have to come from the client with the FTP client installed, correct? If this is true, is there a way of finding the " true" source of the FTP client? Or is this merely a false positive from FortiAnalyzer? Thanks. @ndrew