# This file was automatically generated by bifcl from /opt/local/var/macports/build/_opt_bblocal_var_buildworker_ports_build_ports_net_zeek/zeek-devel/work/zeek-7.0.4/src/analyzer/protocol/rdp/events.bif (plugin mode).

export {
## Generated for RDPEUDP SYN UDP Datagram
##
## c: The connection record for the underlying transport-layer session/flow.
global rdpeudp_syn: event(c: connection );


## Generated for RDPEUDP SYNACK UDP Datagram
##
## c: The connection record for the underlying transport-layer session/flow.
global rdpeudp_synack: event(c: connection );


## Generated when RDPEUDP connections are established (both sides SYN)
##
## c: The connection record for the underlying transport-layer session/flow.
##
## version: Whether the connection is RDPEUDP1 or RDPEUDP2
global rdpeudp_established: event(c: connection , version: count );


## Generated when for data messages exchanged after a RDPEUDP connection establishes
##
## c: The connection record for the underlying transport-layer session/flow.
##
## is_orig: Whether the data was sent by the originator or responder of the connection.
##
## version: Whether the connection is RDPEUDP1 or RDPEUDP2
##
## data: The payload of the packet. This is probably very non-performant.
global rdpeudp_data: event(c: connection , is_orig: bool , version: count , data: string );


## Generated for each packet after RDP native encryption begins
##
## c: The connection record for the underlying transport-layer session/flow.
##
## orig: True if the packet was sent by the originator of the connection.
##
## len: The length of the encrypted data.
global rdp_native_encrypted_data: event(c: connection , orig: bool , len: count );


## Generated for X.224 client requests.
##
## c: The connection record for the underlying transport-layer session/flow.
##
## cookie: The cookie included in the request.
##
## flags: The flags set by the client.
global rdp_connect_request: event(c: connection , cookie: string , flags: count );

global rdp_connect_request: event(c: connection , cookie: string );


## Generated for RDP Negotiation Response messages.
##
## c: The connection record for the underlying transport-layer session/flow.
##
## security_protocol: The security protocol selected by the server.
##
## flags: The flags set by the server.
global rdp_negotiation_response: event(c: connection , security_protocol: count , flags: count );

global rdp_negotiation_response: event(c: connection , security_protocol: count );


## Generated for RDP Negotiation Failure messages.
##
## c: The connection record for the underlying transport-layer session/flow.
##
## failure_code: The failure code sent by the server.
##
## flags: The flags set by the server.
global rdp_negotiation_failure: event(c: connection , failure_code: count , flags: count );

global rdp_negotiation_failure: event(c: connection , failure_code: count );


## Generated for MCS client requests.
##
## c: The connection record for the underlying transport-layer session/flow.
##
## data: The data contained in the client core data structure.
global rdp_client_core_data: event(c: connection , data: RDP::ClientCoreData );


## Generated for client security data packets.
##
## c: The connection record for the underlying transport-layer session/flow.
##
## data: The data contained in the client security data structure.
global rdp_client_security_data: event(c: connection , data: RDP::ClientSecurityData );


## Generated for Client Network Data (TS_UD_CS_NET) packets
##
## c: The connection record for the underlying transport-layer session/flow.
##
## channels: The channels that were requested
global rdp_client_network_data: event(c: connection , channels: RDP::ClientChannelList );


## Generated for client cluster data packets.
##
## c: The connection record for the underlying transport-layer session/flow.
##
## data: The data contained in the client security data structure.
global rdp_client_cluster_data: event(c: connection , data: RDP::ClientClusterData );


## Generated for MCS server responses.
##
## c: The connection record for the underlying transport-layer session/flow.
##
## result: The 8-bit integer representing the GCC Conference Create Response result.
global rdp_gcc_server_create_response: event(c: connection , result: count );


## Generated for MCS server responses.
##
## c: The connection record for the underlying transport-layer session/flow.
##
## encryption_method: The 32-bit integer representing the encryption method used in the connection.
##
## encryption_level: The 32-bit integer representing the encryption level used in the connection.
global rdp_server_security: event(c: connection , encryption_method: count , encryption_level: count );


## Generated for a server certificate section.  If multiple X.509 
## certificates are included in chain, this event will still
## only be generated a single time.
##
## c: The connection record for the underlying transport-layer session/flow.
##
## cert_type: Indicates the type of certificate.
##
## permanently_issued: Value will be true is the certificate(s) is permanent on the server.
global rdp_server_certificate: event(c: connection , cert_type: count , permanently_issued: bool );


## Generated when an RDP session becomes encrypted.
##
## c: The connection record for the underlying transport-layer session/flow.
##
## security_protocol: The security protocol being used for the session.
global rdp_begin_encryption: event(c: connection , security_protocol: count );

} # end of export section
module GLOBAL;
