Hey @paulo_silva,
NTLMSSP (NT LAN Manager Security Support Provider) is a security support provider that is available on all versions of DCOM. It uses the Microsoft Windows NT LAN Manager (NTLM) protocol for authentication.
That being said, I would take a look at the log’s logon_type keyword and see what that states, whether it’s NETWORK, REMOTE, etc. That will give you a better understanding of what type of authentication has happened or was attempted.