I don't know how deep you want to go with the Harvest Dashboards, but for CIFS Connections I could imagine potentially adding a few more attributes, for example:
- Auth Mechanism (auth-mechansim)
- Encryption status (smb-encryption-status)
- Signing (is-session-signed)
- CIFS Protocol version (protocol-version)
An end customer is often interested to know what type of connections their Windows clients are making: Are there any old clients e.g. using SMB 1.0 or are there any unencrypted sessions?
idle-time could also be interesting, I don't know how you would handle that, perhaps using session-id as a key to identify the specific sessions.
I don't know how deep you want to go with the Harvest Dashboards, but for CIFS Connections I could imagine potentially adding a few more attributes, for example:
- Auth Mechanism (auth-mechansim)
- Encryption status (smb-encryption-status)
- Signing (is-session-signed)
- CIFS Protocol version (protocol-version)
An end customer is often interested to know what type of connections their Windows clients are making: Are there any old clients e.g. using SMB 1.0 or are there any unencrypted sessions?
idle-time could also be interesting, I don't know how you would handle that, perhaps using session-id as a key to identify the specific sessions.