:tocdepth: 3

base/protocols/ldap/spicy-events.zeek
=====================================

Events generated by the LDAP analyzer.

See :rfc:`4511`.


Summary
~~~~~~~
Events
######
======================================================== =================================================================
:zeek:id:`LDAP::bind_request`: :zeek:type:`event`        Event generated for each LDAPMessage containing a BindRequest.
:zeek:id:`LDAP::extended_request`: :zeek:type:`event`    Event generated for each ExtendedRequest in LDAP messages.
:zeek:id:`LDAP::extended_response`: :zeek:type:`event`   Event generated for each ExtendedResponse in LDAP messages.
:zeek:id:`LDAP::message`: :zeek:type:`event`             Event generated for each LDAPMessage (either direction).
:zeek:id:`LDAP::search_request`: :zeek:type:`event`      Event generated for each LDAPMessage containing a SearchRequest.
:zeek:id:`LDAP::search_result_entry`: :zeek:type:`event` Event generated for each SearchResultEntry in LDAP messages.
:zeek:id:`LDAP::starttls`: :zeek:type:`event`            Event generated when a plaintext LDAP connection switched to TLS.
======================================================== =================================================================


Detailed Interface
~~~~~~~~~~~~~~~~~~
Events
######
.. zeek:id:: LDAP::bind_request
   :source-code: base/protocols/ldap/main.zeek 396 427

   :Type: :zeek:type:`event` (c: :zeek:type:`connection`, message_id: :zeek:type:`int`, version: :zeek:type:`int`, name: :zeek:type:`string`, auth_type: :zeek:type:`LDAP::BindAuthType`, auth_info: :zeek:type:`string`)

   Event generated for each LDAPMessage containing a BindRequest.


   :param c: The connection.


   :param message_id: The messageID element.


   :param version: The version field in the BindRequest.


   :param name: The name field in the BindRequest.


   :param auth_type: The auth type field in the BindRequest.


   :param auth_info: Additional information related to the used auth type.

.. zeek:id:: LDAP::extended_request
   :source-code: base/protocols/ldap/spicy-events.zeek 111 111

   :Type: :zeek:type:`event` (c: :zeek:type:`connection`, message_id: :zeek:type:`int`, request_name: :zeek:type:`string`, request_value: :zeek:type:`string`)

   Event generated for each ExtendedRequest in LDAP messages.


   :param c: The connection.


   :param message_id: The messageID element.


   :param request_name: The name of the extended request.


   :param request_value: The value of the extended request (empty if missing).

.. zeek:id:: LDAP::extended_response
   :source-code: base/protocols/ldap/spicy-events.zeek 129 129

   :Type: :zeek:type:`event` (c: :zeek:type:`connection`, message_id: :zeek:type:`int`, result: :zeek:type:`LDAP::ResultCode`, response_name: :zeek:type:`string`, response_value: :zeek:type:`string`)

   Event generated for each ExtendedResponse in LDAP messages.


   :param c: The connection.


   :param message_id: The messageID element.


   :param result: The result code of the response.


   :param response_name: The name of the extended response (empty if missing).


   :param response_value: The value of the extended response (empty if missing).

.. zeek:id:: LDAP::message
   :source-code: base/protocols/ldap/main.zeek 218 317

   :Type: :zeek:type:`event` (c: :zeek:type:`connection`, message_id: :zeek:type:`int`, opcode: :zeek:type:`LDAP::ProtocolOpcode`, result: :zeek:type:`LDAP::ResultCode`, matched_dn: :zeek:type:`string`, diagnostic_message: :zeek:type:`string`, object: :zeek:type:`string`, argument: :zeek:type:`string`)

   Event generated for each LDAPMessage (either direction).


   :param c: The connection.


   :param message_id: The messageID element.


   :param opcode: The protocolOp field in the message.


   :param result: The result code if the message contains a result.


   :param matched_dn: The DN if the message contains a result.


   :param diagnostic_message: Diagnostic message if the LDAP message contains a result.


   :param object: The object name this message refers to.


   :param argument: Additional arguments this message includes.

.. zeek:id:: LDAP::search_request
   :source-code: base/protocols/ldap/main.zeek 329 378

   :Type: :zeek:type:`event` (c: :zeek:type:`connection`, message_id: :zeek:type:`int`, base_object: :zeek:type:`string`, scope: :zeek:type:`LDAP::SearchScope`, deref: :zeek:type:`LDAP::SearchDerefAlias`, size_limit: :zeek:type:`int`, time_limit: :zeek:type:`int`, types_only: :zeek:type:`bool`, filter: :zeek:type:`string`, attributes: :zeek:type:`vector` of :zeek:type:`string`)

   Event generated for each LDAPMessage containing a SearchRequest.


   :param c: The connection.


   :param message_id: The messageID element.


   :param base_object: The baseObject field in the SearchRequest.


   :param scope: The scope field in the SearchRequest.


   :param deref_alias: The derefAlias field in the SearchRequest


   :param size_limit: The sizeLimit field in the SearchRequest.


   :param time_limit: The timeLimit field in the SearchRequest.


   :param types_only: The typesOnly field in the SearchRequest.


   :param filter: The string representation of the filter field in the SearchRequest.


   :param attributes: Additional attributes of the SearchRequest.

.. zeek:id:: LDAP::search_result_entry
   :source-code: base/protocols/ldap/main.zeek 383 388

   :Type: :zeek:type:`event` (c: :zeek:type:`connection`, message_id: :zeek:type:`int`, object_name: :zeek:type:`string`)

   Event generated for each SearchResultEntry in LDAP messages.


   :param c: The connection.


   :param message_id: The messageID element.


   :param object_name: The object name in the SearchResultEntry.

.. zeek:id:: LDAP::starttls
   :source-code: base/protocols/ldap/spicy-events.zeek 141 141

   :Type: :zeek:type:`event` (c: :zeek:type:`connection`)

   Event generated when a plaintext LDAP connection switched to TLS.


   :param c: The connection.



