Potential brute force attempts

Hey, I am a beginner on this, but I am trying to distinguish between legitimate traffic and password-craking tools.
What methods can an administrator use to identify the application, service, script, or task that is initiating logins over the network to another computer? For example, on two servers in which server 1 logs in to server 2 over the network using NTLM, the Windows event viewer only shows the failed login logs on server 2 with the source workstation name …

administrator application beginner brute can computer cybersecurity hey identify logins logs network password script server servers service task tools traffic