Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 16:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add username tracking

Browse source
This commit is contained in:
Vlad Grigorescu 2014-10-08 17:23:20 -04:00
parent f38a580c8c
commit 10db1b552d
2 changed files with 46 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

14
scripts/base/protocols/smb/main.bro
View file

@ -95,9 +95,14 @@ export {
## Version of SMB for the command
version : string &log;
## Authenticated username, if available
username : string &log &optional;
## If this is related to a tree, this is the tree
## that was used for the current command.
tree : string &log &optional;
## The type of tree (disk share, printer share, named pipe, etc.)
tree_service : string &log &optional;
## If the command referenced a file, store it here.
referenced_file : FileInfo &optional;
@ -116,11 +121,13 @@ export {
current_tree : TreeInfo &optional;
## Indexed on MID to map responses to requests.
pending_cmds : table[count] of CmdInfo &optional;
pending_cmds: table[count] of CmdInfo &optional;
## File map to retrieve file information based on the file ID.
fid_map : table[count] of FileInfo &optional;
fid_map : table[count] of FileInfo &optional;
## Tree map to retrieve tree information based on the tree ID.
tid_map : table[count] of TreeInfo &optional;
tid_map : table[count] of TreeInfo &optional;
## User map to retrieve user name based on the user ID.
uid_map : table[count] of string &optional;
};
redef record connection += {
@ -133,6 +140,7 @@ export {
const deferred_logging_cmds: set[string] = {
"NEGOTIATE",
"SESSION_SETUP_ANDX",
"TREE_CONNECT_ANDX",
};
## This is an internally used function.