RDP
If an RDP session is “upgraded” to SSL, this will be indicated with this script in a new field added to the RDP log.
/scripts/policy/protocols/rdp/indicate_ssl.bro
RDP::Info
record
policy/protocols/smb/log-cmds.bro
policy/protocols/mysql/software.bro