Project

General

Profile

Download (7.36 KB)

Feature #8764 » eve_netlogon_fixed.json

Egor Kotov, 07/24/2026 09:40 AM

 
{"timestamp":"2026-07-23T18:43:42.010182+0300","flow_id":1725537996396608,"pcap_cnt":6,"event_type":"smb","src_ip":"192.168.57.131","src_port":49925,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:42aqbdr03pyq0NILXbO0gNZcl/w=","tx_id":0,"smb":{"id":1,"dialect":"2.??","command":"SMB1_COMMAND_NEGOTIATE_PROTOCOL","status":"STATUS_SUCCESS","status_code":"0x0","session_id":0,"tree_id":0,"client_dialects":["NT LM 0.12","SMB 2.002","SMB 2.???"],"server_guid":"a7064ebe-83e3-4bee-dbba-110d8c54f7d0","max_read_size":8388608,"max_write_size":8388608},"pcap_filename":"/root/suricata_traffic/netlogon.pcap"}
{"timestamp":"2026-07-23T18:43:42.013361+0300","flow_id":1725537996396608,"pcap_cnt":8,"event_type":"smb","src_ip":"192.168.57.131","src_port":49925,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:42aqbdr03pyq0NILXbO0gNZcl/w=","tx_id":1,"smb":{"id":2,"dialect":"3.11","command":"SMB2_COMMAND_NEGOTIATE_PROTOCOL","status":"STATUS_SUCCESS","status_code":"0x0","session_id":0,"tree_id":0,"client_dialects":["2.02","2.10","3.00","3.02","3.11"],"client_guid":"14562eea-85df-11f1-d79e-0c00b0731d29","server_guid":"a7064ebe-83e3-4bee-dbba-110d8c54f7d0","max_read_size":8388608,"max_write_size":8388608},"pcap_filename":"/root/suricata_traffic/netlogon.pcap"}
{"timestamp":"2026-07-23T18:43:42.018019+0300","flow_id":1725537996396608,"pcap_cnt":13,"event_type":"smb","src_ip":"192.168.57.131","src_port":49925,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:42aqbdr03pyq0NILXbO0gNZcl/w=","tx_id":2,"smb":{"id":3,"dialect":"3.11","command":"SMB2_COMMAND_SESSION_SETUP","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906421,"tree_id":0,"kerberos":{"realm":"CORP.LOCAL","snames":["cifs","WIN-A761HG0941U.corp.local"]}},"pcap_filename":"/root/suricata_traffic/netlogon.pcap"}
{"timestamp":"2026-07-23T18:43:42.018714+0300","flow_id":1725537996396608,"pcap_cnt":15,"event_type":"smb","src_ip":"192.168.57.131","src_port":49925,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:42aqbdr03pyq0NILXbO0gNZcl/w=","tx_id":3,"smb":{"id":4,"dialect":"3.11","command":"SMB2_COMMAND_TREE_CONNECT","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906421,"tree_id":1,"named_pipe":"\\\\WIN-A761HG0941U.corp.local\\IPC$","share_type":"PIPE"},"pcap_filename":"/root/suricata_traffic/netlogon.pcap"}
{"timestamp":"2026-07-23T18:43:42.019531+0300","flow_id":1725537996396608,"pcap_cnt":17,"event_type":"smb","src_ip":"192.168.57.131","src_port":49925,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:42aqbdr03pyq0NILXbO0gNZcl/w=","tx_id":4,"smb":{"id":5,"dialect":"3.11","command":"SMB2_COMMAND_CREATE","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906421,"tree_id":1,"filename":"NETLOGON","disposition":"FILE_OPEN","access":"normal","created":0,"accessed":0,"modified":0,"changed":0,"size":0,"fuid":"00000298-0009-0000-0001-000000000009"},"pcap_filename":"/root/suricata_traffic/netlogon.pcap"}
{"timestamp":"2026-07-23T18:43:42.023860+0300","flow_id":1725537996396608,"pcap_cnt":22,"event_type":"smb","src_ip":"192.168.57.131","src_port":49925,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:42aqbdr03pyq0NILXbO0gNZcl/w=","tx_id":5,"smb":{"id":6,"dialect":"3.11","command":"SMB2_COMMAND_IOCTL","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906421,"tree_id":1,"function":"FSCTL_QUERY_NETWORK_INTERFACE_INFO"},"pcap_filename":"/root/suricata_traffic/netlogon.pcap"}
{"timestamp":"2026-07-23T18:43:42.025701+0300","flow_id":1725537996396608,"pcap_cnt":26,"event_type":"smb","src_ip":"192.168.57.131","src_port":49925,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:42aqbdr03pyq0NILXbO0gNZcl/w=","tx_id":6,"smb":{"id":7,"dialect":"3.11","command":"SMB2_COMMAND_WRITE","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906421,"tree_id":1,"dcerpc":{"request":"BIND","response":"BINDACK","interfaces":[{"uuid":"12345678-1234-abcd-ef00-01234567cffb","version":"1.0","ack_result":2,"ack_reason":0},{"uuid":"12345678-1234-abcd-ef00-01234567cffb","version":"1.0","ack_result":0,"ack_reason":0},{"uuid":"12345678-1234-abcd-ef00-01234567cffb","version":"1.0","ack_result":3,"ack_reason":0}],"call_id":2}},"pcap_filename":"/root/suricata_traffic/netlogon.pcap"}
{"timestamp":"2026-07-23T18:43:42.027050+0300","flow_id":1725537996396608,"pcap_cnt":28,"event_type":"smb","src_ip":"192.168.57.131","src_port":49925,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:42aqbdr03pyq0NILXbO0gNZcl/w=","tx_id":7,"smb":{"id":8,"dialect":"3.11","command":"SMB2_COMMAND_IOCTL","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906421,"tree_id":1,"dcerpc":{"request":"REQUEST","response":"RESPONSE","opnum":40,"req":{"frag_cnt":1,"stub_data_size":92},"interfaces":[{"uuid":"12345678-1234-abcd-ef00-01234567cffb","version":"1.0"}],"res":{"frag_cnt":1,"stub_data_size":204},"call_id":2}},"pcap_filename":"/root/suricata_traffic/netlogon.pcap"}
{"timestamp":"2026-07-23T18:43:42.008542+0300","flow_id":1725537996396608,"event_type":"smb","src_ip":"192.168.57.131","src_port":49925,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"stream (flow timeout)","community_id":"1:42aqbdr03pyq0NILXbO0gNZcl/w=","tx_id":8,"smb":{"id":9,"dialect":"3.11","command":"SMB2_COMMAND_CLOSE","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906421,"tree_id":1},"pcap_filename":"/root/suricata_traffic/netlogon.pcap"}
{"timestamp":"2026-07-23T18:43:42.008542+0300","flow_id":1725537996396608,"event_type":"flow","src_ip":"192.168.57.131","src_port":49925,"dest_ip":"192.168.57.129","dest_port":445,"ip_v":4,"proto":"TCP","app_proto":"smb","flow":{"pkts_toserver":15,"pkts_toclient":14,"bytes_toserver":5983,"bytes_toclient":3144,"start":"2026-07-23T18:43:42.008542+0300","end":"2026-07-23T18:43:42.027594+0300","age":0,"state":"established","reason":"shutdown","alerted":false,"tx_cnt":9},"community_id":"1:42aqbdr03pyq0NILXbO0gNZcl/w=","tcp":{"tcp_flags":"1a","tcp_flags_ts":"1a","tcp_flags_tc":"1a","syn":true,"psh":true,"ack":true,"state":"established","ts_max_regions":1,"tc_max_regions":1},"pcap_filename":"/root/suricata_traffic/netlogon.pcap"}
{"timestamp":"2026-07-24T12:02:39.064623+0300","event_type":"stats","stats":{"uptime":1,"decoder":{"pkts":29,"bytes":9127,"ipv4":29,"ethernet":29,"tcp":29,"avg_pkt_size":314,"max_pkt_size":1514},"tcp":{"syn":1,"synack":1,"sessions":1,"ssn_from_pool":1,"segment_from_cache":19,"segment_from_pool":5,"memuse":3735552,"reassembly_memuse":688128},"flow":{"total":1,"tcp":1,"wrk":{"spare_sync_avg":100,"spare_sync":1,"flows_evicted_needs_work":1,"flows_evicted_pkt_inject":2,"flows_injected":1},"end":{"state":{"established":1},"tcp_state":{"established":1}},"mgr":{"rows_per_sec":6553},"spare":9900,"memuse":7154304},"app_layer":{"flow":{"smb":1},"tx":{"smb":9}},"memcap":{"pressure":1,"pressure_max":1},"defrag":{"memuse":33554432},"http":{"byterange":{"memuse":168384,"memcap":104857600}},"ippair":{"memuse":398144,"memcap":16777216},"host":{"memuse":382144,"memcap":33554432}},"pcap_filename":"\/root\/suricata_traffic\/netlogon.pcap"}
(2-2/6)