Host file would not work for this..

This is not a DNS based name resolution.

The idea is that if we see this IP on network traffic, we verify its identity using multiple methods.

One of these methods is sending a crafted payload to Udp/137 that is expected to make the endpoint reply with it's netbios name....

 

The alert will pop up if more that 90% of our tries failed. 

this could be due to blocked port or high latency to many endpoints or to few endpoints that responsible for most of the traffic.

 

We can turn on a trace for a few hours which will tell us which IPs are failing, but you need to contat support for that.