[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[ISSForum] signature to enable for tracking denied file/drive access ?
I need to know which signature i need to enable if i
need to track the users accessing file shares and
getting denied access .
I would be interested in getting the source ip ,dst
ip,src port,dst port,file name,drive (C,D or E etc for
windows or relevant drive names for other os),username
and password the user used for accessing the shared
file/folder and got denied.
I tried with smb_empty_password , but this doesnot
provide info on the file names , drive
Any insight on this would be highly appreciated.
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
ISSForum mailing list
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx
The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.