base/protocols/ntlm/main.bro

NTLM

Namespace:NTLM Imports:base/frameworks/dpd, base/protocols/smb Source File:/scripts/base/protocols/ntlm/main.bro

Summary

Options

NTLM::auth_failure_statuses: set &redef

DOS and NT status codes that indicate authentication failure.

Types

NTLM::Info: record

Redefinitions

DPD::ignore_violations: set &redef
Log::ID: enum
connection: record

Detailed Interface

Options

NTLM::auth_failure_statuses

Type:set [count] Attributes:&redef Default:

{
   86900737,
   3221225578,
   3221225586,
   146931714,
   3221225585,
   3221225569,
   3221225584,
   3221225506,
   146800642,
   3221225583,
   146866178,
   3221225581
}

DOS and NT status codes that indicate authentication failure.

Types

NTLM::Info

Type:

record

ts: time &log

Timestamp for when the event happened.

uid: string &log

Unique ID for the connection.

id: conn_id &log

The connection’s 4-tuple of endpoint addresses/ports.

username: string &log &optional

Username given by the client.

hostname: string &log &optional

Hostname given by the client.

domainname: string &log &optional

Domainname given by the client.

success: bool &log &optional

Indicate whether or not the authentication was successful.

status: string &log &optional

A string representation of the status code that was returned in response to the authentication attempt.

done: bool &default = F &optional

Internally used field to indicate if the login attempt has already been logged.