Actions
Feature #8403
open
JF
CT
smb: add samr_UserInfo details to EVE logs
Feature #8403:
smb: add samr_UserInfo details to EVE logs
Effort:
Difficulty:
Label:
Description
samr_UserInfo such as Account Name and Full Name is available in the SMB payload, and we can potentially
detect credential theft with them, but they're not exposed as JSON fields in our logs.
These are good candidates to be logged.
I've added a pcap to #5685 that has these fields as example on packet 339.
Actions