5 commits

Author	SHA1	Message	Date
Seth Hall	8eb67a0a6c	Update tests to match move of smb base scripts into policy/	2016-06-20 16:22:57 -04:00
Seth Hall	e2dfaf8a5b	Fixes to SMB file handling and logging. ... There were some cases where the log would be missing a field or data wouldn't get sent to file analysis. At least some of this is fixed now and I get confused a bit less when I look at the logs now. Also, I made the default handling "FILE" so that things like FILE_UNKNOWN wouldn't show up in the logs so regularly. It's technically correct that way, but it doesn't look good and it's correct as FILE often enough that it make sense to make it the default I think.	2016-04-01 09:43:13 -04:00
Seth Hall	5721db4be7	Lots of cleanup and improvement to DCE/RPC analyzer. ... - It works with DCE/RPC over SMB1+2 now. - Using named pipes in 1+2 and the transaction cmd in SMB1. - Base scripts based on work by Josh Liburdi. - New dce_rpc.log. Feedback on how to make this log more compact and useful would be appreciated.	2016-04-01 09:38:52 -04:00
Seth Hall	6e842cf4da	Fix a problem I introduced with SMB2 file handling. ... - Added an SMB2 test that encompasses the problem.	2016-03-07 15:36:25 -05:00
Seth Hall	21d8cab0c0	First SMB test.	2016-03-07 13:50:25 -05:00