This is the first I've heard of it, and did some searching on the net.
Looks like attune was installed by default in some commercial software packages.
It looks like it was supposed to periodically check your configuration against a database of some kind at aveo.com in order to warn the user of possible problems.
Cosmi shipped it as part of their software.
Cosmi has a FAQ about attune on their web site which talks about disabling and deinstalling it:
http://www.cosmi.com/support/attune_faq.htm
Looks like even McAfee had an alliance with them in the past:
http://www.mcafee.com/aboutus/press_room/press_releases/pr12209902.asp
So you may want to check your systems and see if it was loaded as part of another software program.
It could also be some other program and not attune that is generating these packets.
If you can verify that the ips in your network have attune loaded, and if you turn off attune the alarm stops firing then you are likely correct that it is attune.
You'll have to decide then on your own whether or not to disable or even de-install attune.
If you leave it enabled you would need to Exclude the loki signature where aveo.com's ip address is the source of the alarm, and possibly a second Exclude where aveo.com is the destination of the alarm since the address may be the source in one firing and a dest in another firing.
A sniffer trace of the icmp packets in a libpcap format as mcerha requested would be very helpful.
If you don't have a sniffer that generates libpcap formatted files (like tcpdump) , then you can:
1) set the action for loki to iplog, and set it to iplog for at least 5 minutes (the default of 15 is also fine)
2) let the alarm fire.
3) wait for the time of the iplog
4) set the action for loki back to what ever you had it before (likely none)
5) send mcerha the iplog file(s) from the /usr/nr/var/iplog/new directory for the ip address that fired the loki alarm. (there may be several)
(If the files are large then you can use a program like ethereal or tcpdump to read in the file and only write out the icmp packets from the file. You can then compress it if you like.)
