mirror of
https://github.com/zeek/zeek.git
synced 2025-10-13 03:58:20 +00:00
7e9d48f532
The broxygen-generated files now live in the git repo, have tests that check that they are up-to-date, and a script to re-generate them on-demand.
39 lines
1.2 KiB
ReStructuredText
39 lines
1.2 KiB
ReStructuredText
:tocdepth: 3
|
|
|
|
base/bif/plugins/Bro_SMB.events.bif.bro
|
|
=======================================
|
|
.. bro:namespace:: GLOBAL
|
|
|
|
|
|
:Namespace: GLOBAL
|
|
|
|
Summary
|
|
~~~~~~~
|
|
Events
|
|
######
|
|
======================================================= ===================================================================
|
|
:bro:id:`smb_pipe_connect_heuristic`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)` connections when a
|
|
named pipe has been detected heuristically.
|
|
======================================================= ===================================================================
|
|
|
|
|
|
Detailed Interface
|
|
~~~~~~~~~~~~~~~~~~
|
|
Events
|
|
######
|
|
.. bro:id:: smb_pipe_connect_heuristic
|
|
|
|
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
|
|
|
Generated for :abbr:`SMB (Server Message Block)` connections when a
|
|
named pipe has been detected heuristically. The case when this comes
|
|
up is when the drive mapping isn't seen so the analyzer is not able
|
|
to determine whether to send the data to the files framework or to
|
|
the DCE_RPC analyzer. This heuristic can be tuned by adding or
|
|
removing "named pipe" names from the :bro:see:`SMB::pipe_filenames`
|
|
const.
|
|
|
|
|
|
:c: The connection.
|
|
|
|
|