NTLM is Microsoft’s old mythological authentication protocol. Although new and better authentication protocol has already been developed, NTLM is still very much in use. NTLM protocol has proven to have many flaws that result in potential vulnerabilities. One caution measure that can be taken is auditing and logging any NTLM traffic events.
View full blog post: https://calcomsoftware.com/the-policy-expert-network-security-restrict-ntlm-audit-incoming-ntlm-traffic/