[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[ISSForum] signature to enable for tracking denied file/drive access ?

Dear Members,

I need to know which signature i need to enable if i
need to track the users accessing file shares and
getting denied access .

I would be interested in getting the source ip ,dst
ip,src port,dst port,file name,drive (C,D or E etc for
windows or relevant drive names for other os),username
and password the user used for accessing the shared
file/folder and got denied.

I tried with smb_empty_password , but this doesnot
provide info on the file names , drive
letters,username etc

Any insight on this would be highly appreciated.

Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
ISSForum mailing list

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.