GLOBAL
Namespace: | GLOBAL |
---|---|
Source File: | /scripts/base/bif/plugins/Bro_SMB.events.bif.bro |
smb_com_close : event |
Generated for SMB/CIFS messages of type close. |
smb_com_generic_andx : event |
Generated for SMB/CIFS messages of type generic andx. |
smb_com_logoff_andx : event |
Generated for SMB/CIFS messages of type logoff andx. |
smb_com_negotiate : event |
Generated for SMB/CIFS messages of type negotiate. |
smb_com_negotiate_response : event |
Generated for SMB/CIFS messages of type negotiate response. |
smb_com_nt_create_andx : event |
Generated for SMB/CIFS messages of type nt create andx. |
smb_com_read_andx : event |
Generated for SMB/CIFS messages of type read andx. |
smb_com_setup_andx : event |
Generated for SMB/CIFS messages of type setup andx. |
smb_com_trans_mailslot : event |
Generated for SMB/CIFS messages of type transaction mailslot. |
smb_com_trans_pipe : event |
Generated for SMB/CIFS messages of type transaction pipe. |
smb_com_trans_rap : event |
Generated for SMB/CIFS messages of type transaction rap. |
smb_com_transaction : event |
Generated for SMB/CIFS messages of type nt transaction. |
smb_com_transaction2 : event |
Generated for SMB/CIFS messages of type nt transaction 2. |
smb_com_tree_connect_andx : event |
Generated for SMB/CIFS messages of type tree connect andx. |
smb_com_tree_disconnect : event |
Generated for SMB/CIFS messages of type tree disconnect. |
smb_com_write_andx : event |
Generated for SMB/CIFS messages of type read andx. |
smb_error : event |
Generated for SMB/CIFS messages that indicate an error. |
smb_get_dfs_referral : event |
Generated for SMB/CIFS messages of type get dfs referral. |
smb_message : event |
Generated for all SMB/CIFS messages. |
smb_com_close
Type: | event (c: connection , hdr: smb_hdr ) |
---|
Generated for SMB/CIFS messages of type close.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
See also: smb_com_generic_andx
, smb_com_logoff_andx
, smb_com_negotiate
, smb_com_negotiate_response
, smb_com_nt_create_andx
, smb_com_read_andx
, smb_com_setup_andx
, smb_com_trans_mailslot
, smb_com_trans_pipe
, smb_com_trans_rap
, smb_com_transaction
, smb_com_transaction2
, smb_com_tree_connect_andx
, smb_com_tree_disconnect
, smb_com_write_andx
, smb_error
, smb_get_dfs_referral
, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
smb_com_generic_andx
Type: | event (c: connection , hdr: smb_hdr ) |
---|
Generated for SMB/CIFS messages of type generic andx.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
See also: smb_com_close
, smb_com_logoff_andx
, smb_com_negotiate
, smb_com_negotiate_response
, smb_com_nt_create_andx
, smb_com_read_andx
, smb_com_setup_andx
, smb_com_trans_mailslot
, smb_com_trans_pipe
, smb_com_trans_rap
, smb_com_transaction
, smb_com_transaction2
, smb_com_tree_connect_andx
, smb_com_tree_disconnect
, smb_com_write_andx
, smb_error
, smb_get_dfs_referral
, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
smb_com_logoff_andx
Type: | event (c: connection , hdr: smb_hdr ) |
---|
Generated for SMB/CIFS messages of type logoff andx.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
See also: smb_com_close
, smb_com_generic_andx
, smb_com_negotiate
, smb_com_negotiate_response
, smb_com_nt_create_andx
, smb_com_read_andx
, smb_com_setup_andx
, smb_com_trans_mailslot
, smb_com_trans_pipe
, smb_com_trans_rap
, smb_com_transaction
, smb_com_transaction2
, smb_com_tree_connect_andx
, smb_com_tree_disconnect
, smb_com_write_andx
, smb_error
, smb_get_dfs_referral
, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
smb_com_negotiate
Type: | event (c: connection , hdr: smb_hdr ) |
---|
Generated for SMB/CIFS messages of type negotiate.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
See also: smb_com_close
, smb_com_generic_andx
, smb_com_logoff_andx
, smb_com_negotiate_response
, smb_com_nt_create_andx
, smb_com_read_andx
, smb_com_setup_andx
, smb_com_trans_mailslot
, smb_com_trans_pipe
, smb_com_trans_rap
, smb_com_transaction
, smb_com_transaction2
, smb_com_tree_connect_andx
, smb_com_tree_disconnect
, smb_com_write_andx
, smb_error
, smb_get_dfs_referral
, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
smb_com_negotiate_response
Type: | event (c: connection , hdr: smb_hdr , dialect_index: count ) |
---|
Generated for SMB/CIFS messages of type negotiate response.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Dialect_index: | The dialect indicated in the message. |
See also: smb_com_close
, smb_com_generic_andx
, smb_com_logoff_andx
, smb_com_negotiate
, smb_com_nt_create_andx
, smb_com_read_andx
, smb_com_setup_andx
, smb_com_trans_mailslot
, smb_com_trans_pipe
, smb_com_trans_rap
, smb_com_transaction
, smb_com_transaction2
, smb_com_tree_connect_andx
, smb_com_tree_disconnect
, smb_com_write_andx
, smb_error
, smb_get_dfs_referral
, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
smb_com_nt_create_andx
Type: | event (c: connection , hdr: smb_hdr , name: string ) |
---|
Generated for SMB/CIFS messages of type nt create andx.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Name: | The name attribute specified in the message. |
See also: smb_com_close
, smb_com_generic_andx
, smb_com_logoff_andx
, smb_com_negotiate
, smb_com_negotiate_response
, smb_com_read_andx
, smb_com_setup_andx
, smb_com_trans_mailslot
, smb_com_trans_pipe
, smb_com_trans_rap
, smb_com_transaction
, smb_com_transaction2
, smb_com_tree_connect_andx
, smb_com_tree_disconnect
, smb_com_write_andx
, smb_error
, smb_get_dfs_referral
, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
smb_com_read_andx
Type: | event (c: connection , hdr: smb_hdr , data: string ) |
---|
Generated for SMB/CIFS messages of type read andx.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Data: | Always empty. |
See also: smb_com_close
, smb_com_generic_andx
, smb_com_logoff_andx
, smb_com_negotiate
, smb_com_negotiate_response
, smb_com_nt_create_andx
, smb_com_setup_andx
, smb_com_trans_mailslot
, smb_com_trans_pipe
, smb_com_trans_rap
, smb_com_transaction
, smb_com_transaction2
, smb_com_tree_connect_andx
, smb_com_tree_disconnect
, smb_com_write_andx
, smb_error
, smb_get_dfs_referral
, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
smb_com_setup_andx
Type: | event (c: connection , hdr: smb_hdr ) |
---|
Generated for SMB/CIFS messages of type setup andx.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
See also: smb_com_close
, smb_com_generic_andx
, smb_com_logoff_andx
, smb_com_negotiate
, smb_com_negotiate_response
, smb_com_nt_create_andx
, smb_com_read_andx
, smb_com_trans_mailslot
, smb_com_trans_pipe
, smb_com_trans_rap
, smb_com_transaction
, smb_com_transaction2
, smb_com_tree_connect_andx
, smb_com_tree_disconnect
, smb_com_write_andx
, smb_error
, smb_get_dfs_referral
, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
smb_com_trans_mailslot
Type: | event (c: connection , hdr: smb_hdr , trans: smb_trans , data: smb_trans_data , is_orig: bool ) |
---|
Generated for SMB/CIFS messages of type transaction mailslot.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Trans: | The parsed transaction header. |
Data: | The raw transaction data. |
Is_orig: | True if the message was sent by the originator of the connection. |
See also: smb_com_close
, smb_com_generic_andx
, smb_com_logoff_andx
, smb_com_negotiate
, smb_com_negotiate_response
, smb_com_nt_create_andx
, smb_com_read_andx
, smb_com_setup_andx
, smb_com_trans_pipe
, smb_com_trans_rap
, smb_com_transaction
, smb_com_transaction2
, smb_com_tree_connect_andx
, smb_com_tree_disconnect
, smb_com_write_andx
, smb_error
, smb_get_dfs_referral
, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
smb_com_trans_pipe
Type: | event (c: connection , hdr: smb_hdr , trans: smb_trans , data: smb_trans_data , is_orig: bool ) |
---|
Generated for SMB/CIFS messages of type transaction pipe.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Trans: | The parsed transaction header. |
Data: | The raw transaction data. |
Is_orig: | True if the message was sent by the originator of the connection. |
See also: smb_com_close
, smb_com_generic_andx
, smb_com_logoff_andx
, smb_com_negotiate
, smb_com_negotiate_response
, smb_com_nt_create_andx
, smb_com_read_andx
, smb_com_setup_andx
, smb_com_trans_mailslot
, smb_com_trans_rap
, smb_com_transaction
, smb_com_transaction2
, smb_com_tree_connect_andx
, smb_com_tree_disconnect
, smb_com_write_andx
, smb_error
, smb_get_dfs_referral
, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
smb_com_trans_rap
Type: | event (c: connection , hdr: smb_hdr , trans: smb_trans , data: smb_trans_data , is_orig: bool ) |
---|
Generated for SMB/CIFS messages of type transaction rap.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Trans: | The parsed transaction header. |
Data: | The raw transaction data. |
Is_orig: | True if the message was sent by the originator of the connection. |
See also: smb_com_close
, smb_com_generic_andx
, smb_com_logoff_andx
, smb_com_negotiate
, smb_com_negotiate_response
, smb_com_nt_create_andx
, smb_com_read_andx
, smb_com_setup_andx
, smb_com_trans_mailslot
, smb_com_trans_pipe
, smb_com_transaction
, smb_com_transaction2
, smb_com_tree_connect_andx
, smb_com_tree_disconnect
, smb_com_write_andx
, smb_error
, smb_get_dfs_referral
, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
smb_com_transaction
Type: | event (c: connection , hdr: smb_hdr , trans: smb_trans , data: smb_trans_data , is_orig: bool ) |
---|
Generated for SMB/CIFS messages of type nt transaction.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Trans: | The parsed transaction header. |
Data: | The raw transaction data. |
Is_orig: | True if the message was sent by the originator of the connection. |
See also: smb_com_close
, smb_com_generic_andx
, smb_com_logoff_andx
, smb_com_negotiate
, smb_com_negotiate_response
, smb_com_nt_create_andx
, smb_com_read_andx
, smb_com_setup_andx
, smb_com_trans_mailslot
, smb_com_trans_pipe
, smb_com_trans_rap
, smb_com_transaction2
, smb_com_tree_connect_andx
, smb_com_tree_disconnect
, smb_com_write_andx
, smb_error
, smb_get_dfs_referral
, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
smb_com_transaction2
Type: | event (c: connection , hdr: smb_hdr , trans: smb_trans , data: smb_trans_data , is_orig: bool ) |
---|
Generated for SMB/CIFS messages of type nt transaction 2.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Trans: | The parsed transaction header. |
Data: | The raw transaction data. |
Is_orig: | True if the message was sent by the originator of the connection. |
See also: smb_com_close
, smb_com_generic_andx
, smb_com_logoff_andx
, smb_com_negotiate
, smb_com_negotiate_response
, smb_com_nt_create_andx
, smb_com_read_andx
, smb_com_setup_andx
, smb_com_trans_mailslot
, smb_com_trans_pipe
, smb_com_trans_rap
, smb_com_transaction
, smb_com_tree_connect_andx
, smb_com_tree_disconnect
, smb_com_write_andx
, smb_error
, smb_get_dfs_referral
, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
smb_com_tree_connect_andx
Type: | event (c: connection , hdr: smb_hdr , path: string , service: string ) |
---|
Generated for SMB/CIFS messages of type tree connect andx.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Path: | The path attribute specified in the message. |
Service: | The service attribute specified in the message. |
See also: smb_com_close
, smb_com_generic_andx
, smb_com_logoff_andx
, smb_com_negotiate
, smb_com_negotiate_response
, smb_com_nt_create_andx
, smb_com_read_andx
, smb_com_setup_andx
, smb_com_trans_mailslot
, smb_com_trans_pipe
, smb_com_trans_rap
, smb_com_transaction
, smb_com_transaction2
, smb_com_tree_disconnect
, smb_com_write_andx
, smb_error
, smb_get_dfs_referral
, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
smb_com_tree_disconnect
Type: | event (c: connection , hdr: smb_hdr ) |
---|
Generated for SMB/CIFS messages of type tree disconnect.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
See also: smb_com_close
, smb_com_generic_andx
, smb_com_logoff_andx
, smb_com_negotiate
, smb_com_negotiate_response
, smb_com_nt_create_andx
, smb_com_read_andx
, smb_com_setup_andx
, smb_com_trans_mailslot
, smb_com_trans_pipe
, smb_com_trans_rap
, smb_com_transaction
, smb_com_transaction2
, smb_com_tree_connect_andx
, smb_com_write_andx
, smb_error
, smb_get_dfs_referral
, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
smb_com_write_andx
Type: | event (c: connection , hdr: smb_hdr , data: string ) |
---|
Generated for SMB/CIFS messages of type read andx.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Data: | Always empty. |
See also: smb_com_close
, smb_com_generic_andx
, smb_com_logoff_andx
, smb_com_negotiate
, smb_com_negotiate_response
, smb_com_nt_create_andx
, smb_com_read_andx
, smb_com_setup_andx
, smb_com_trans_mailslot
, smb_com_trans_pipe
, smb_com_trans_rap
, smb_com_transaction
, smb_com_transaction2
, smb_com_tree_connect_andx
, smb_com_tree_disconnect
, smb_error
, smb_get_dfs_referral
, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
smb_error
Type: | event (c: connection , hdr: smb_hdr , cmd: count , cmd_str: string , data: string ) |
---|
Generated for SMB/CIFS messages that indicate an error. This event is triggered by an SMB header including a status that signals an error.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Cmd: | The SMB command code. |
Cmd_str: | A string mnemonic of the SMB command code. |
Data: | The raw SMB message body, i.e., the data starting after the SMB header. |
See also: smb_com_close
, smb_com_generic_andx
, smb_com_logoff_andx
, smb_com_negotiate
, smb_com_negotiate_response
, smb_com_nt_create_andx
, smb_com_read_andx
, smb_com_setup_andx
, smb_com_trans_mailslot
, smb_com_trans_pipe
, smb_com_trans_rap
, smb_com_transaction
, smb_com_transaction2
, smb_com_tree_connect_andx
, smb_com_tree_disconnect
, smb_com_write_andx
, smb_get_dfs_referral
, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
smb_get_dfs_referral
Type: | event (c: connection , hdr: smb_hdr , max_referral_level: count , file_name: string ) |
---|
Generated for SMB/CIFS messages of type get dfs referral.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Max_referral_level: | |
The max_referral_level attribute specified in the
message. |
|
File_name: | The filene_name attribute specified in the message. |
See also: smb_com_close
, smb_com_generic_andx
, smb_com_logoff_andx
, smb_com_negotiate
, smb_com_negotiate_response
, smb_com_nt_create_andx
, smb_com_read_andx
, smb_com_setup_andx
, smb_com_trans_mailslot
, smb_com_trans_pipe
, smb_com_trans_rap
, smb_com_transaction
, smb_com_transaction2
, smb_com_tree_connect_andx
, smb_com_tree_disconnect
, smb_com_write_andx
, smb_error
, smb_message
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.
smb_message
Type: | event (c: connection , hdr: smb_hdr , is_orig: bool , cmd: string , body_length: count , body: string ) |
---|
Generated for all SMB/CIFS messages.
See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.
C: | The connection. |
---|---|
Hdr: | The parsed header of the SMB message. |
Is_orig: | True if the message was sent by the originator of the underlying transport-level connection. |
Cmd: | A string mnemonic of the SMB command code. |
Body_length: | The length of the SMB message body, i.e. the data starting after the SMB header. |
Body: | The raw SMB message body, i.e., the data starting after the SMB header. |
See also: smb_com_close
, smb_com_generic_andx
, smb_com_logoff_andx
, smb_com_negotiate
, smb_com_negotiate_response
, smb_com_nt_create_andx
, smb_com_read_andx
, smb_com_setup_andx
, smb_com_trans_mailslot
, smb_com_trans_pipe
, smb_com_trans_rap
, smb_com_transaction
, smb_com_transaction2
, smb_com_tree_connect_andx
, smb_com_tree_disconnect
, smb_com_write_andx
, smb_error
, smb_get_dfs_referral
Todo
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.