События Windows
Decrypt call failed
Вызов функции расшифровки не удался
AI
Event ID 1015
Microsoft-Windows-SMBServer/Security
Основные поля
IP-адрес
IP
Windows
IP
ELK
-
Microsoft Sentinel
-
QRadar
-
Splunk
-
Имя компьютера
Computer
Windows
Computer
ELK
winlog.computer_name
Microsoft Sentinel
-
QRadar
-
Splunk
-
Имя пользователя
Не выбрано
Важное поле
ClientAddress
Windows
Client Address
ELK
-
Microsoft Sentinel
-
QRadar
-
Splunk
-
Поля
| Windows Raw | Windows | ELK | Microsoft Sentinel | QRadar | Splunk |
|---|---|---|---|---|---|
| ClientName | Client Name | winlog.user_data.ClientName | - | - | - |
| ClientAddress | Client Address | - | - | - | - |
| Status | Status | winlog.event_data.Status | - | - | - |
| IP Системное поле | IP Системное поле | - | - | - | - |
| Computer Системное поле | Computer Системное поле | winlog.computer_name | - | - | - |
| ProcessID Системное поле | ProcessID Системное поле | winlog.process.pid | - | - | - |
| ThreadID Системное поле | ThreadID Системное поле | winlog.process.thread.id | - | - | - |
Пример события
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-SMBServer" Guid="{d48ce617-33a2-4bc3-a5c7-11aa4f29619e}" />
<EventID>1015</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>1015</Task>
<Opcode>0</Opcode>
<Keywords>0x800000000000008</Keywords>
<TimeCreated SystemTime="2026-08-02T14:45:55.0051341Z" />
<EventRecordID>363</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="10172" />
<Channel>Microsoft-Windows-SMBServer/Security</Channel>
<Computer>DC.socpedia.net</Computer>
<Security UserID="S-1-5-18" />
</System>
- <UserData>
- <EventData xmlns="Smb2Namespace">
<ClientNameLength>30</ClientNameLength>
<ClientName>\</ClientName>
<ClientAddressLength>128</ClientAddressLength>
<ClientAddress>0200DE8AC0A800ED00000000000000000000FFFFC0A800ED0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000</ClientAddress>
<Status>0xc0000203</Status>
<TranslatedStatus>0xc0000203</TranslatedStatus>
<SessionID>0x0</SessionID>
</EventData>
</UserData>
</Event>