Debug log:
Failed auth:
Aug 4 19:52:42 atlas 1 2024-08-04T19:52:42.684904+02:00 atlas.in.chaos1.de TNAUDIT_SMB 35098 - - @cee:{"TNAUDIT": {"aid": "37ce29ac-b213-4956-969d-aba9aac0eb42", "vers": {"major": 0, "minor": 1}, "addr": "192.168.220.142", "user": "wlr", "sess": null, "time": "2024-08-04 17:52:42.684840Z", "svc": "SMB", "svc_data": "{\"vers\": {\"major\": 0, \"minor\": 1}, \"service\": null, \"session_id\": null, \"tcon_id\": null}", "event": "AUTHENTICATION", "event_data": "{\"logonId\": \"0\", \"logonType\": 3, \"localAddress\": \"ipv4:192.168.220.20:445\", \"remoteAddress\": \"ipv4:192.168.220.142:50020\", \"serviceDescription\": \"SMB2\", \"authDescription\": null, \"clientDomain\": \"ATLAS\", \"clientAccount\": \"wlr\", \"workstation\": \"ATLAS\", \"becameAccount\": \"wlr\", \"becameDomain\": \"ATLAS\", \"becameSid\": \"S-1-5-21-3242936988-131677294-3909876623-20036\", \"mappedAccount\": \"wlr\", \"mappedDomain\": \"ATLAS\", \"netlogonComputer\": null, \"netlogonTrustAccount\": null, \"netlogonNegotiateFlags\": \"0x00000000\", \"netlogonSecureChannelType\": 0, \"netlogonTrustAccountSid\": null, \"passwordType\": \"NTLMv2\", \"clientPolicyAccessCheck\": null, \"serverPolicyAccessCheck\": null, \"vers\": {\"major\": 0, \"minor\": 1}, \"result\": {\"type\": \"NTSTATUS\", \"value_raw\": 0, \"value_parsed\": \"SUCCESS\"}}", "success": true}}
Valid auth:
Aug 4 18:14:26 atlas 1 2024-08-04T18:14:26.799568+02:00 atlas.in.chaos1.de TNAUDIT_SMB 33890 - - @cee:{"TNAUDIT": {"aid": "dee0a660-8510-4e10-91dc-06430f028a2a", "vers": {"major": 0, "minor": 1}, "addr": "192.168.220.124", "user": "ajr", "sess": null, "time": "2024-08-04 16:14:26.799530Z", "svc": "SMB", "svc_data": "{\"vers\": {\"major\": 0, \"minor\": 1}, \"service\": null, \"session_id\": null, \"tcon_id\": null}", "event": "AUTHENTICATION", "event_data": "{\"logonId\": \"0\", \"logonType\": 3, \"localAddress\": \"ipv4:192.168.220.20:445\", \"remoteAddress\": \"ipv4:192.168.220.124:52262\", \"serviceDescription\": \"SMB2\", \"authDescription\": null, \"clientDomain\": \"ATLAS\", \"clientAccount\": \"ajr\", \"workstation\": \"AXELS-IMAC\", \"becameAccount\": \"ajr\", \"becameDomain\": \"TRUENAS\", \"becameSid\": \"S-1-5-21-3242936988-131677294-3909876623-20035\", \"mappedAccount\": \"ajr\", \"mappedDomain\": \"ATLAS\", \"netlogonComputer\": null, \"netlogonTrustAccount\": null, \"netlogonNegotiateFlags\": \"0x00000000\", \"netlogonSecureChannelType\": 0, \"netlogonTrustAccountSid\": null, \"passwordType\": \"NTLMv2\", \"clientPolicyAccessCheck\": null, \"serverPolicyAccessCheck\": null, \"vers\": {\"major\": 0, \"minor\": 1}, \"result\": {\"type\": \"NTSTATUS\", \"value_raw\": 0, \"value_parsed\": \"SUCCESS\"}}", "success": true}}