Namespace: | GLOBAL |
---|---|
Source File: | /scripts/base/bif/plugins/Bro_RDP.events.bif.bro |
rdp_begin_encryption: event | Generated when an RDP session becomes encrypted. |
rdp_client_core_data: event | Generated for MCS client requests. |
rdp_connect_request: event | Generated for X.224 client requests. |
rdp_gcc_server_create_response: event | Generated for MCS server responses. |
rdp_negotiation_failure: event | Generated for RDP Negotiation Failure messages. |
rdp_negotiation_response: event | Generated for RDP Negotiation Response messages. |
rdp_server_certificate: event | Generated for a server certificate section. |
rdp_server_security: event | Generated for MCS server responses. |
Type: | event (c: connection, security_protocol: count) |
---|
Generated when an RDP session becomes encrypted.
C: | The connection record for the underlying transport-layer session/flow. |
---|---|
Security_protocol: | |
The security protocol being used for the session. |
Type: | event (c: connection, data: RDP::ClientCoreData) |
---|
Generated for MCS client requests.
C: | The connection record for the underlying transport-layer session/flow. |
---|---|
Data: | The data contained in the client core data structure. |
Type: | event (c: connection, cookie: string) |
---|
Generated for X.224 client requests.
C: | The connection record for the underlying transport-layer session/flow. |
---|---|
Cookie: | The cookie included in the request. |
Type: | event (c: connection, result: count) |
---|
Generated for MCS server responses.
C: | The connection record for the underlying transport-layer session/flow. |
---|---|
Result: | The 8-bit integer representing the GCC Conference Create Response result. |
Type: | event (c: connection, failure_code: count) |
---|
Generated for RDP Negotiation Failure messages.
C: | The connection record for the underlying transport-layer session/flow. |
---|---|
Failure_code: | The failure code sent by the server. |
Type: | event (c: connection, security_protocol: count) |
---|
Generated for RDP Negotiation Response messages.
C: | The connection record for the underlying transport-layer session/flow. |
---|---|
Security_protocol: | |
The security protocol selected by the server. |
Type: | event (c: connection, cert_type: count, permanently_issued: bool) |
---|
Generated for a server certificate section. If multiple X.509 certificates are included in chain, this event will still only be generated a single time.
C: | The connection record for the underlying transport-layer session/flow. |
---|---|
Cert_type: | Indicates the type of certificate. |
Permanently_issued: | |
Value will be true is the certificate(s) is permanent on the server. |
Type: | event (c: connection, encryption_method: count, encryption_level: count) |
---|
Generated for MCS server responses.
C: | The connection record for the underlying transport-layer session/flow. |
---|---|
Encryption_method: | |
The 32-bit integer representing the encryption method used in the connection. | |
Encryption_level: | |
The 32-bit integer representing the encryption level used in the connection. |