Re: ntsyslog events detection failed
Veaceslav Grecea <[email protected]> Thu, 3 Dec 2009 10:51:36 +0200
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
2009/12/3 Paul Robert Marino: > Veaceslav Grecea wrote: >> Dec 2 17:17:30 1.1.1.1 NODE NT: <Security;F529;NT AUTHORITY\SYSTEM> >> Logon Failure: Reason:Unknown user name or bad password User >> Name:username Domain:dname Logon Type:3 Logon Process:NtLmSsp >> Authentication Package:NTLM Workstation Name:376K4 Caller User >> Name:- Caller Domain:- Caller Logon ID:- Caller Process ID:- >> Transited Services:- Source Network Address:1.1.2.4 Source Port:0 > is this a multi line message in the file? No, it's an one line message. A copy-paste error. _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user