Suricata

We have the regular event_type SMB logs.
Some alert detection additions of SMB keywords could be very useful.

Example: many status codes "Access denied" or "Log on failure" from the same origin can easily reveal brute forcing or miss configuration.
This data can be extracted and seen in the default generated Suricata SMB logs, however it is very helpful to be able to alert on that and other cases.
Suggestions for keywords that we already have logged in SMB as logs , but would be useful if available as keywords:

• smb status code
• smb command