# \#ntlm

**URL:** https://community.zeek.org/tag/ntlm/42.md

[Latest](https://community.zeek.org/latest.md) · [Categories](https://community.zeek.org/categories.md) · [Tags](https://community.zeek.org/tags.md)

---

## [How to Hook NTLM Log Events Before They're Written (NTLM::log\_policy)](https://community.zeek.org/t/how-to-hook-ntlm-log-events-before-theyre-written-ntlm-log-policy/7317)

<div class="topic-metadata">

**Author:** [@Francisco](https://community.zeek.org/u/Francisco)\
**Replies:** 5\
**Last updated:** [March 18, 2024, 5:15pm UTC](https://community.zeek.org/t/how-to-hook-ntlm-log-events-before-theyre-written-ntlm-log-policy/7317 "2024-03-18T17:15:35Z")

</div>

Good afternoon, I am trying to capture the ntlm script data just before it is sent to the log frame. In the known equipment script or services conidos in the rst file I have found an event that facilitates this action, …