zeek/scripts
Seth Hall a176e053ca Improve NTLM authentication logging.
If only one side of a connection was seen, the ntlm.log
would indicate that the authentication failed.  This has been
modified so that the success is listed as null since it's not
known whether or not the authentication was successful.

It can be inferred from continued SMB analysis though because
activity will continue taking place.  I changed it though
because the log shouldn't assume more than what it sees.
2016-04-13 12:26:07 -04:00
..
base Improve NTLM authentication logging. 2016-04-13 12:26:07 -04:00
broxygen Fix Broxygen coverage. 2015-03-13 14:53:11 -05:00
policy Merge remote-tracking branch 'origin/master' into topic/seth/file-entropy 2016-03-21 11:39:15 -04:00
site Merge branch 'master' of https://github.com/aaronmbr/bro 2015-07-23 13:05:28 -07:00
CMakeLists.txt Don't install test-all-policy.bro script as it's for testing only. 2011-10-12 12:42:12 -05:00
test-all-policy.bro Merge remote-tracking branch 'origin/master' into topic/seth/file-entropy 2016-03-21 11:39:15 -04:00