Sessions DoS?

[riverstech]

I've been seeing thousands of sessions on our Fortigate 300b the sessions are in this format

"name"@my.minbox.com(Internal computer IP address) device: internal Core switch. I disconnect the session but they come right back. I have IDS and AV running, I tried blocking the minbox source by IP and I blocked outgoing SMTP on this VDOM. My thoughts are these sessions are not normal maybe a relay or spoof? does anyone have any thoughts on blocking this?

Thank you

RiversTech

[MikePruett]

I would look at the endpoints that are initiating them and run scans for malware and malicious software.