Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Clarify the cookie field's origin in the RDP log.

Browse source
This commit is contained in:
Christian Kreibich 2025-07-08 16:31:57 -07:00
parent 0c60f2a70a
commit 2ca0fb6539
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
scripts/base/protocols/rdp/main.zeek
View file

@ -18,7 +18,8 @@ export {
## The connection's 4-tuple of endpoint addresses/ports. ## The connection's 4-tuple of endpoint addresses/ports.
id: conn_id &log; id: conn_id &log;
## Cookie value used by the client machine. ## Cookie value used by the client machine.
## This is typically a username. ## This is typically a username, but note that it will often
## be truncated on the wire, to a maximum of 9 characters.
cookie: string &log &optional; cookie: string &log &optional;
## Status result for the connection. It's a mix between ## Status result for the connection. It's a mix between
## RDP negotiation failure messages and GCC server create ## RDP negotiation failure messages and GCC server create