Malicious replication of Directory Services- Alert for iPv6

Question

When ever a DC with iPv6 tries to replicate with its partner, it shows as malicious.

which is false positive, how to avoid this.

Answer 1

You need to check why the sensor is failing to resolve this IP address to the machine name (which will allow it to understand this is a DC...)
Are all the ports open as described in the docs?
If yes, open a support ticket, as it's tricky to diagnose this over a forum thread...