actions in smb_files.log

Zeek
1

Hi

What is the reason that I don’t get action SMB::FILE_WRITE?

I try to copy files \ create new files \ change files but still no SMB::FILE_WRITE

I only have open,rename,delete

Thanks

Izik Birka

2

Hi Izik,

Without an example pcap its difficult to troubleshoot your issue. Are you using a custom Bro script?

-AK