base/bif/plugins/Bro_RDP.events.bif.bro

GLOBAL

Namespace:GLOBAL Source File:/scripts/base/bif/plugins/Bro_RDP.events.bif.bro

Summary

Events

rdp_begin_encryption: event	Generated when an RDP session becomes encrypted.
rdp_client_core_data: event	Generated for MCS client requests.
rdp_connect_request: event	Generated for X.224 client requests.
rdp_gcc_server_create_response: event	Generated for MCS server responses.
rdp_negotiation_failure: event	Generated for RDP Negotiation Failure messages.
rdp_negotiation_response: event	Generated for RDP Negotiation Response messages.
rdp_server_certificate: event	Generated for a server certificate section.
rdp_server_security: event	Generated for MCS server responses.

Detailed Interface

Events

rdp_begin_encryption

Type:event (c: connection, security_protocol: count)

Generated when an RDP session becomes encrypted.

C:The connection record for the underlying transport-layer session/flow. Security_protocol:  The security protocol being used for the session.

rdp_client_core_data

Type:event (c: connection, data: RDP::ClientCoreData)

Generated for MCS client requests.

C:The connection record for the underlying transport-layer session/flow. Data:The data contained in the client core data structure.

rdp_connect_request

Type:event (c: connection, cookie: string)

Generated for X.224 client requests.

C:The connection record for the underlying transport-layer session/flow. Cookie:The cookie included in the request.

rdp_gcc_server_create_response

Type:event (c: connection, result: count)

Generated for MCS server responses.

C:The connection record for the underlying transport-layer session/flow. Result:The 8-bit integer representing the GCC Conference Create Response result.

rdp_negotiation_failure

Type:event (c: connection, failure_code: count)

Generated for RDP Negotiation Failure messages.

C:The connection record for the underlying transport-layer session/flow. Failure_code:The failure code sent by the server.

rdp_negotiation_response

Type:event (c: connection, security_protocol: count)

Generated for RDP Negotiation Response messages.

C:The connection record for the underlying transport-layer session/flow. Security_protocol:  The security protocol selected by the server.

rdp_server_certificate

Type:event (c: connection, cert_type: count, permanently_issued: bool)

Generated for a server certificate section. If multiple X.509 certificates are included in chain, this event will still only be generated a single time.

C:The connection record for the underlying transport-layer session/flow. Cert_type:Indicates the type of certificate. Permanently_issued:  Value will be true is the certificate(s) is permanent on the server.

rdp_server_security

Type:event (c: connection, encryption_method: count, encryption_level: count)

Generated for MCS server responses.

C:The connection record for the underlying transport-layer session/flow. Encryption_method:  The 32-bit integer representing the encryption method used in the connection. Encryption_level:  The 32-bit integer representing the encryption level used in the connection.