What does the ARO: New Server detected mean?

The 'New Server Detected' ARO is based on data acquired from the Field Effect MDR network sensor. 

The analytic monitors for internet-accessible services outside of ports 80, 443, and 3389 by reviewing established TCP connections and checking whether the client IP address is outside the network's expected range.

There can be false positives with this ARO in situations where the client IP for the connection is a public IP for the network, or when there is a VPN connection to another trusted network. 

In order to reduce those cases, maintaining an up-to-date list of your organization's public IPs in the Field Effect Portal is helpful. When you add IPs to the Portal, an analyst validates them and tags them in the Field Effect MDR appliance. Field Effect typically issues this ARO as an Observation to make you aware of your threat surface and help ensure you expose only minimal services. 

If the service is required and expected, you can dismiss those AROs to update your monitoring profile and suppress future reporting for that port on that server.