i want to know the source of this alert

Hi,

click on a message and that expanded display should show you the details you are after.

Ian

Likely it will only show your Firewall. On the Firewall you will see properly the DNS Server? Do you use Sophos Central for your Endpoints? 

yes i use it

yes i use it

Do you have XDR in your license? Can you check? Because this would be able to verify the root cause of this ATP alerts via Live Discover.