Microsoft.Windows.Sense.Ndr

Title	Sample	Rule
dns	Y	N
weird	Y	N
http	Y	N
SenseNdrArpEvent	Y	N
conn	Y	N
files	Y	N
NdrTelemetriesEvent	Y	N
ntlm	Y	N
SenseNdrIPHeaderEvent	Y	N
SenseNdrSignatureEvent	Y	N
SenseNdrUdpHeaderEvent	Y	N
kerberos	Y	N
SenseNdrNbnsEvent	Y	N
ssl	Y	N
SenseNdrTcpHeaderEvent	Y	N
dce_rpc	Y	N

dns

Level: 4

Fields #

Name	Description
`AA`
`AdapterDefaultGateways`
`AdapterDefaultGatewaysMac`
`AdapterIpAddresses`
`AdapterMac`
`DstMac`
`FirstPacketId`
`IsOutgoingPacket`
`MacExtractor`
`NdrProcess`
`NdrVersion`
`NetworkAdapterId`
`NetworkCategory`
`NetworkDomainType`
`NetworkName`
`NetworkNamesFromRegistry`
`PacketTimestamp`
`ProcessId`
`ProcessStartKey`
`RA`
`RD`
`SessionDirection`
`SrcMac`
`TC`
`TTLs`
`Z`
`answers`
`id.orig_h`
`id.orig_p`
`id.resp_h`
`id.resp_p`
`proto`
`qclass`
`qclass_name`
`qtype`
`qtype_name`
`query`
`rcode`
`rcode_name`
`rejected`
`rtt`
`trans_id`
`ts`
`uid`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1580,
      "thread_id": 5060
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Sense.Ndr",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:50:12.484Z",
    "version": 0
  },
  "event_data": {
    "AA": "false",
    "AdapterDefaultGateways": "10.2.10.254",
    "AdapterDefaultGatewaysMac": "bc:24:11:22:5b:57",
    "AdapterIpAddresses": "10.2.10.21/24",
    "AdapterMac": "bc:24:11:9a:4d:c2",
    "DstMac": "bc:24:11:41:f2:58",
    "FirstPacketId": "{EF6FE16B-C143-458E-B8CD-A231A038CED9}",
    "IsOutgoingPacket": true,
    "MacExtractor": "Zeek",
    "NdrProcess": "SenseNdr.exe",
    "NdrVersion": "4.0.0.15",
    "NetworkAdapterId": "{8A1760B6-DC99-4B90-9C4A-029698E5AE27}",
    "NetworkCategory": 2,
    "NetworkDomainType": 2,
    "NetworkName": "ludus.domain",
    "NetworkNamesFromRegistry": "ludus.domain",
    "PacketTimestamp": 134291334097250881,
    "ProcessId": 2024,
    "ProcessStartKey": 9288674231451683,
    "RA": "false",
    "RD": "true",
    "SessionDirection": "Out",
    "SrcMac": "bc:24:11:9a:4d:c2",
    "TC": "false",
    "TTLs": "<Zeek-Unset>",
    "Z": "0",
    "answers": "<Zeek-Unset>",
    "id.orig_h": "10.2.10.21",
    "id.orig_p": "55899",
    "id.resp_h": "10.2.10.11",
    "id.resp_p": "53",
    "proto": "udp",
    "qclass": "1",
    "qclass_name": "C_INTERNET",
    "qtype": "1",
    "qtype_name": "A",
    "query": "h1.example.com",
    "rcode": "0",
    "rcode_name": "NOERROR",
    "rejected": "false",
    "rtt": "<Zeek-Unset>",
    "trans_id": "46666",
    "ts": "134291334124790000",
    "uid": "CgWs6v1Du8dHzqVLLg"
  },
  "message": ""
}

weird

Level: 4

Fields #

Name	Description
`AdapterDefaultGateways`
`AdapterDefaultGatewaysMac`
`AdapterIpAddresses`
`AdapterMac`
`DstMac`
`FirstPacketId`
`IsOutgoingPacket`
`MacExtractor`
`NdrProcess`
`NdrVersion`
`NetworkAdapterId`
`NetworkCategory`
`NetworkDomainType`
`NetworkName`
`NetworkNamesFromRegistry`
`PacketTimestamp`
`ProcessId`
`ProcessStartKey`
`SessionDirection`
`SrcMac`
`addl`
`id.orig_h`
`id.orig_p`
`id.resp_h`
`id.resp_p`
`name`
`notice`
`peer`
`source`
`ts`
`uid`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1580,
      "thread_id": 7436
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Sense.Ndr",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 19:56:13.691Z",
    "version": 0
  },
  "event_data": {
    "AdapterDefaultGateways": "",
    "AdapterDefaultGatewaysMac": "",
    "AdapterIpAddresses": "",
    "AdapterMac": "",
    "DstMac": "",
    "FirstPacketId": "",
    "IsOutgoingPacket": false,
    "MacExtractor": "",
    "NdrProcess": "SenseNdr.exe",
    "NdrVersion": "4.0.0.15",
    "NetworkAdapterId": "",
    "NetworkCategory": 0,
    "NetworkDomainType": 0,
    "NetworkName": "",
    "NetworkNamesFromRegistry": "",
    "PacketTimestamp": 0,
    "ProcessId": 0,
    "ProcessStartKey": 0,
    "SessionDirection": "",
    "SrcMac": "",
    "addl": "<Zeek-Unset>",
    "id.orig_h": "<Zeek-Unset>",
    "id.orig_p": "<Zeek-Unset>",
    "id.resp_h": "<Zeek-Unset>",
    "id.resp_p": "<Zeek-Unset>",
    "name": "ip_hdr_len_zero",
    "notice": "false",
    "peer": "zeek",
    "source": "IP",
    "ts": "134291373683786750",
    "uid": "<Zeek-Unset>"
  },
  "message": ""
}

http

Level: 4

Fields #

Name	Description
`AdapterDefaultGateways`
`AdapterDefaultGatewaysMac`
`AdapterIpAddresses`
`AdapterMac`
`DstMac`
`FirstPacketId`
`IsOutgoingPacket`
`MacExtractor`
`NdrProcess`
`NdrVersion`
`NetworkAdapterId`
`NetworkCategory`
`NetworkDomainType`
`NetworkName`
`NetworkNamesFromRegistry`
`PacketTimestamp`
`ProcessId`
`ProcessStartKey`
`SessionDirection`
`SrcMac`
`host`
`id.orig_h`
`id.orig_p`
`id.resp_h`
`id.resp_p`
`info_code`
`info_msg`
`ja4h`
`ja4h_r`
`ja4h_ro`
`method`
`orig_filenames`
`orig_fuids`
`orig_mime_types`
`origin`
`password`
`proxied`
`referrer`
`request_body_len`
`resp_filenames`
`resp_fuids`
`resp_mime_types`
`response_body_len`
`server_name`
`status_code`
`status_msg`
`tags`
`trans_depth`
`ts`
`uid`
`uri`
`user_agent`
`username`
`version`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1580,
      "thread_id": 1608
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Sense.Ndr",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 19:55:17.465Z",
    "version": 0
  },
  "event_data": {
    "AdapterDefaultGateways": "10.2.10.254",
    "AdapterDefaultGatewaysMac": "bc:24:11:22:5b:57",
    "AdapterIpAddresses": "10.2.10.21/24",
    "AdapterMac": "bc:24:11:9a:4d:c2",
    "DstMac": "bc:24:11:22:5b:57",
    "FirstPacketId": "{6EB8AF04-821C-4DE3-AB8D-4C566CDE3089}",
    "IsOutgoingPacket": true,
    "MacExtractor": "Zeek",
    "NdrProcess": "SenseNdr.exe",
    "NdrVersion": "4.0.0.15",
    "NetworkAdapterId": "{8A1760B6-DC99-4B90-9C4A-029698E5AE27}",
    "NetworkCategory": 2,
    "NetworkDomainType": 2,
    "NetworkName": "ludus.domain",
    "NetworkNamesFromRegistry": "ludus.domain",
    "PacketTimestamp": 134291373136880340,
    "ProcessId": 1600,
    "ProcessStartKey": 9288674231451670,
    "SessionDirection": "Out",
    "SrcMac": "bc:24:11:9a:4d:c2",
    "host": "crl.verisign.com",
    "id.orig_h": "10.2.10.21",
    "id.orig_p": "60477",
    "id.resp_h": "162.159.142.9",
    "id.resp_p": "80",
    "info_code": "<Zeek-Unset>",
    "info_msg": "<Zeek-Unset>",
    "ja4h": "ge11nn090000_9e45d1cd324f_e3b0c44298fc_e3b0c44298fc",
    "ja4h_r": "ge11nn090000_Cache-Control,Connection,Accept,Accept-Encoding,If-Modified-Since,User-Agent,X-P2P-PeerDist,X-P2P-PeerDistEx,Host__",
    "ja4h_ro": "ge11nn090000_Cache-Control,Connection,Accept,Accept-Encoding,If-Modified-Since,User-Agent,X-P2P-PeerDist,X-P2P-PeerDistEx,Host__",
    "method": "GET",
    "orig_filenames": "<Zeek-Unset>",
    "orig_fuids": "<Zeek-Unset>",
    "orig_mime_types": "<Zeek-Unset>",
    "origin": "<Zeek-Unset>",
    "password": "<Zeek-Unset>",
    "proxied": "<Zeek-Unset>",
    "referrer": "<Zeek-Unset>",
    "request_body_len": "0",
    "resp_filenames": "<Zeek-Unset>",
    "resp_fuids": [
      "FlDMjv36ybmA7c5EP"
    ],
    "resp_mime_types": "<Zeek-Unset>",
    "response_body_len": "1482",
    "server_name": "cloudflare",
    "status_code": "200",
    "status_msg": "OK",
    "tags": [],
    "trans_depth": "1",
    "ts": "134291373154610000",
    "uid": "CH5EIM1JqHyLcVDc85",
    "uri": "/pca3.crl",
    "user_agent": "Microsoft-CryptoAPI/10.0",
    "username": "<Zeek-Unset>",
    "version": "1.1"
  },
  "message": ""
}

SenseNdrArpEvent

Level: 4

Fields #

Name	Description
`AdapterDefaultGateways`
`AdapterDefaultGatewaysMac`
`AdapterIpAddresses`
`AdapterMac`
`DestMAC`
`IsOutgoingPacket`
`NdrProcess`
`NdrVersion`
`NetworkAdapterId`
`NetworkCategory`
`NetworkDomainType`
`NetworkName`
`NetworkNamesFromRegistry`
`OpCode`
`PacketTimestamp`
`ProcessId`
`ProcessStartKey`
`SenderIp`
`SenderMac`
`SrcMAC`
`TargetIp`
`TargetMac`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1580,
      "thread_id": 7752
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Sense.Ndr",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:50:04.423Z",
    "version": 0
  },
  "event_data": {
    "AdapterDefaultGateways": "10.2.10.254",
    "AdapterDefaultGatewaysMac": "bc:24:11:22:5b:57",
    "AdapterIpAddresses": "10.2.10.21/24",
    "AdapterMac": "bc:24:11:9a:4d:c2",
    "DestMAC": "bc:24:11:9a:4d:c2",
    "IsOutgoingPacket": false,
    "NdrProcess": "SenseNdr.exe",
    "NdrVersion": "4.0.0.15",
    "NetworkAdapterId": "{8A1760B6-DC99-4B90-9C4A-029698E5AE27}",
    "NetworkCategory": 2,
    "NetworkDomainType": 2,
    "NetworkName": "ludus.domain",
    "NetworkNamesFromRegistry": "ludus.domain",
    "OpCode": 1,
    "PacketTimestamp": 134291334006587640,
    "ProcessId": 4294967295,
    "ProcessStartKey": 0,
    "SenderIp": "10.2.10.254",
    "SenderMac": "bc:24:11:22:5b:57",
    "SrcMAC": "bc:24:11:22:5b:57",
    "TargetIp": "10.2.10.21",
    "TargetMac": "00:00:00:00:00:00"
  },
  "message": ""
}

conn

Level: 4

Fields #

Name	Description
`AdapterDefaultGateways`
`AdapterDefaultGatewaysMac`
`AdapterIpAddresses`
`AdapterMac`
`DstMac`
`FirstPacketId`
`IsOutgoingPacket`
`MacExtractor`
`NdrProcess`
`NdrVersion`
`NetworkAdapterId`
`NetworkCategory`
`NetworkDomainType`
`NetworkName`
`NetworkNamesFromRegistry`
`PacketTimestamp`
`ProcessId`
`ProcessStartKey`
`SessionDirection`
`SrcMac`
`conn_state`
`duration`
`history`
`id.orig_h`
`id.orig_p`
`id.resp_h`
`id.resp_p`
`ja4t`
`ja4ts`
`local_orig`
`local_resp`
`missed_bytes`
`orig_bytes`
`orig_ip_bytes`
`orig_l2_addr`
`orig_pkts`
`proto`
`resp_bytes`
`resp_ip_bytes`
`resp_l2_addr`
`resp_pkts`
`service`
`speculative_service`
`ts`
`tunnel_parents`
`uid`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1580,
      "thread_id": 10624
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Sense.Ndr",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:50:08.439Z",
    "version": 0
  },
  "event_data": {
    "AdapterDefaultGateways": "10.2.10.254",
    "AdapterDefaultGatewaysMac": "bc:24:11:22:5b:57",
    "AdapterIpAddresses": "10.2.10.21/24",
    "AdapterMac": "bc:24:11:9a:4d:c2",
    "DstMac": "bc:24:11:9a:4d:c2",
    "FirstPacketId": "{57E91ECE-4593-434E-A33D-F7F387329A7C}",
    "IsOutgoingPacket": false,
    "MacExtractor": "Zeek",
    "NdrProcess": "SenseNdr.exe",
    "NdrVersion": "4.0.0.15",
    "NetworkAdapterId": "{8A1760B6-DC99-4B90-9C4A-029698E5AE27}",
    "NetworkCategory": 2,
    "NetworkDomainType": 2,
    "NetworkName": "ludus.domain",
    "NetworkNamesFromRegistry": "ludus.domain",
    "PacketTimestamp": 134291334001603835,
    "ProcessId": 4294967295,
    "ProcessStartKey": 0,
    "SessionDirection": "In",
    "SrcMac": "bc:24:11:22:5b:57",
    "conn_state": "SF",
    "duration": "0.06257295608520508",
    "history": "ShADdafF",
    "id.orig_h": "10.2.20.61",
    "id.orig_p": "35284",
    "id.resp_h": "10.2.10.21",
    "id.resp_p": "5986",
    "ja4t": "64240_2-4-8-1-3_1460_7",
    "ja4ts": "65535_2-1-3-1-1-4_1460_8",
    "local_orig": "<Zeek-Unset>",
    "local_resp": "<Zeek-Unset>",
    "missed_bytes": "0",
    "orig_bytes": "3768",
    "orig_ip_bytes": "4148",
    "orig_l2_addr": "bc:24:11:22:5b:57",
    "orig_pkts": "9",
    "proto": "tcp",
    "resp_bytes": "2434",
    "resp_ip_bytes": "556",
    "resp_l2_addr": "bc:24:11:9a:4d:c2",
    "resp_pkts": "6",
    "service": "ssl",
    "speculative_service": "<Zeek-Unset>",
    "ts": "134291334001603830",
    "tunnel_parents": "<Zeek-Unset>",
    "uid": "CIqq6P1asdWsrUYI28"
  },
  "message": ""
}

files

Level: 4

Fields #

Name	Description
`AdapterDefaultGateways`
`AdapterDefaultGatewaysMac`
`AdapterIpAddresses`
`AdapterMac`
`DstMac`
`FirstPacketId`
`IsOutgoingPacket`
`MacExtractor`
`NdrProcess`
`NdrVersion`
`NetworkAdapterId`
`NetworkCategory`
`NetworkDomainType`
`NetworkName`
`NetworkNamesFromRegistry`
`PacketTimestamp`
`ProcessId`
`ProcessStartKey`
`SessionDirection`
`SrcMac`
`analyzers`
`depth`
`duration`
`entropy`
`filename`
`fuid`
`id.orig_h`
`id.orig_p`
`id.resp_h`
`id.resp_p`
`is_orig`
`local_orig`
`md5`
`mime_type`
`missing_bytes`
`overflow_bytes`
`parent_fuid`
`seen_bytes`
`sha1`
`sha256`
`source`
`timedout`
`total_bytes`
`ts`
`uid`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1580,
      "thread_id": 10320
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Sense.Ndr",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:50:12.482Z",
    "version": 0
  },
  "event_data": {
    "AdapterDefaultGateways": "10.2.10.254",
    "AdapterDefaultGatewaysMac": "bc:24:11:22:5b:57",
    "AdapterIpAddresses": "10.2.10.21/24",
    "AdapterMac": "bc:24:11:9a:4d:c2",
    "DstMac": "bc:24:11:22:5b:57",
    "FirstPacketId": "{420BAE2B-628A-4660-944A-491C4BE5160A}",
    "IsOutgoingPacket": true,
    "MacExtractor": "Zeek",
    "NdrProcess": "SenseNdr.exe",
    "NdrVersion": "4.0.0.15",
    "NetworkAdapterId": "{8A1760B6-DC99-4B90-9C4A-029698E5AE27}",
    "NetworkCategory": 2,
    "NetworkDomainType": 2,
    "NetworkName": "ludus.domain",
    "NetworkNamesFromRegistry": "ludus.domain",
    "PacketTimestamp": 134291334089171801,
    "ProcessId": 1176,
    "ProcessStartKey": 9288674231461491,
    "SessionDirection": "Out",
    "SrcMac": "bc:24:11:9a:4d:c2",
    "analyzers": [
      "SHA256",
      "ENTROPY"
    ],
    "depth": "0",
    "duration": "0",
    "entropy": "5.032806933567878",
    "filename": "<Zeek-Unset>",
    "fuid": "Fct7XU1RQ2qun093s2",
    "id.orig_h": "10.2.10.21",
    "id.orig_p": "57580",
    "id.resp_h": "172.66.147.243",
    "id.resp_p": "80",
    "is_orig": "false",
    "local_orig": "<Zeek-Unset>",
    "md5": "<Zeek-Unset>",
    "mime_type": "<Zeek-Unset>",
    "missing_bytes": "0",
    "overflow_bytes": "0",
    "parent_fuid": "<Zeek-Unset>",
    "seen_bytes": "559",
    "sha1": "<Zeek-Unset>",
    "sha256": "ff67a9d764d6a2367a187734e697f6a53217db9a21c101d410a113ca871a299d",
    "source": "HTTP",
    "timedout": "false",
    "total_bytes": "<Zeek-Unset>",
    "ts": "134291334124790000",
    "uid": "C3R6wW3jkINaStdoFj"
  },
  "message": ""
}

NdrTelemetriesEvent

Level: 4

Fields #

Name	Description
`TelemetriesInfoAsJson`
`TelemetryName`
`TelemetryTimestamp`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1580,
      "thread_id": 8132
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Sense.Ndr",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 20:31:57.124Z",
    "version": 0
  },
  "event_data": {
    "TelemetriesInfoAsJson": {
      "AdaptersMetadata": [
        {
          "AdapterGuid": "{8A1760B6-DC99-4B90-9C4A-029698E5AE27}",
          "AdapterPktmonId": 2,
          "PromiscuousMode": false
        }
      ],
      "Capping": {
        "SenseNdrArpEvent": {
          "{43646baf-e9ee-48f9-955c-2be217b42789}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 5
            },
            "Local": {
              "Dropped": 1140,
              "TotalSeen": 1140
            }
          },
          "{8e3d491b-9e60-4172-a26d-69dd66bd1ace}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 21
            },
            "Local": {
              "Dropped": 244,
              "TotalSeen": 244
            }
          }
        },
        "SenseNdrDhcpEvent": {
          "{64ffce63-f7ca-4a7a-bc3e-2e4bb6df82a5}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 4
            }
          }
        },
        "SenseNdrIPHeaderEvent": {
          "{436e876c-54f5-4b49-a333-0ffc1b4609c3}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 11
            },
            "Local": {
              "Dropped": 120,
              "TotalSeen": 120
            }
          }
        },
        "SenseNdrLlmnrEvent": {
          "{91f4fb64-e930-43e5-8100-0376f9ff9ecc}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 11
            }
          }
        },
        "SenseNdrMdnsEvent": {
          "{a2a2b70d-e64e-4a50-85bc-6bd6cee784e3}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 4
            }
          }
        },
        "SenseNdrNbnsEvent": {
          "{75614b97-9333-465a-b428-027d77926e97}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 17
            },
            "Local": {
              "Dropped": 4,
              "TotalSeen": 4
            }
          }
        },
        "SenseNdrSignatureEvent": {
          "{2d7a7757-673e-456d-8cfe-b4a3d7fef9ff}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 7
            },
            "Local": {
              "Dropped": 3,
              "TotalSeen": 3
            }
          },
          "{3e00421f-e677-41f6-a425-8f76dbdd343b}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 77
            }
          },
          "{762c5555-dba2-4092-be8f-185c945a6732}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 2
            }
          },
          "{993ba8c2-9110-4b2f-828a-62796d576c26}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 4
            }
          },
          "{a238b0c4-29b5-4bcf-a1d5-dbf7cbe8aa83}": {
            "Global": {
              "CappingStartTimestamp": "2026-07-20T14:39:43Z",
              "Dropped": 7820,
              "TotalSeen": 8820
            }
          }
        },
        "SenseNdrTcpHeaderEvent": {
          "{6367d4be-d66f-4df0-bfb7-f7f49fea6885}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 5
            },
            "Local": {
              "Dropped": 4,
              "TotalSeen": 4
            }
          },
          "{9a47ebc6-df95-4afc-8d61-2731c6c62d63}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 452
            },
            "Local": {
              "Dropped": 229,
              "TotalSeen": 245
            }
          }
        },
        "SenseNdrUdpHeaderEvent": {
          "{77a8f813-a280-4320-b9a1-7b6a9831a40d}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 79
            },
            "Local": {
              "Dropped": 678,
              "TotalSeen": 679
            }
          }
        },
        "SenseNdrWsdEvent": {
          "{4c9d992e-58c4-4e1e-a346-94e0208b6ed8}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 2
            }
          }
        },
        "conn": {
          "{3c7778da-5b86-4a5d-b79e-4379b42f48f7}": {
            "Global": {
              "CappingStartTimestamp": "2026-07-19T19:25:35Z",
              "Dropped": 3326,
              "TotalSeen": 4026
            }
          },
          "{9f1dfe54-e0ba-4e15-9335-e9c03969cfd5}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 6
            }
          },
          "{ea8fd541-3dde-46ce-a77e-dc18ce26f406}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 146
            },
            "Local": {
              "Dropped": 11,
              "TotalSeen": 17
            }
          }
        },
        "dce_rpc": {
          "{8b06a26d-1443-4b5a-ab5a-bde27b8a7227}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 3
            }
          }
        },
        "dns": {
          "{15701ca6-c552-4b14-b206-b9715f82bf01}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 539
            },
            "Local": {
              "Dropped": 458,
              "TotalSeen": 474
            }
          }
        },
        "files": {
          "{2eac0135-b397-4fa1-b920-97ecf3603195}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 60
            }
          }
        },
        "http": {
          "{c190fbb2-2a10-4d07-b462-53b2114aa7ac}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 54
            },
            "Local": {
              "Dropped": 53,
              "TotalSeen": 55
            }
          }
        },
        "kerberos": {
          "{4d58111a-6509-44c9-ae54-f4f10d39894f}": {
            "Global": {
              "Dropped": 209,
              "TotalSeen": 209
            }
          },
          "{8f85f707-2d2e-4aff-89d8-6225e075bed7}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 15
            },
            "Local": {
              "Dropped": 1,
              "TotalSeen": 1
            }
          },
          "{fb630927-4652-4417-a427-5045de54bf22}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 2
            }
          }
        },
        "ntlm": {
          "{26948daa-1247-4adf-a0cb-e0ff6b668ad5}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 5
            }
          }
        },
        "smb_files": {
          "{c7995416-9766-4630-b2a9-5eef559fedb2}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 103
            }
          }
        },
        "smb_mapping": {
          "{faaa511b-8b0a-4082-aca7-fb6e4bd08542}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 7
            },
            "Local": {
              "Dropped": 2,
              "TotalSeen": 2
            }
          }
        },
        "smb_server_guid": {
          "{1ba7ecdc-391c-4b01-bb99-1e95d7cf3c88}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 3
            },
            "Local": {
              "Dropped": 2,
              "TotalSeen": 2
            }
          }
        },
        "ssl": {
          "{a37e3f11-e8c2-4bd9-af71-ed3e7d0ed0fb}": {
            "Global": {
              "Dropped": 0,
              "TotalSeen": 256
            },
            "Local": {
              "Dropped": 54,
              "TotalSeen": 63
            }
          }
        }
      },
      "EtwListener": {
        "EtwSession": {
          "BufferSize": 64,
          "BuffersWrittenToFile": 145870,
          "EventsLost": 0,
          "FreeBuffers": 16,
          "LogBuffersLost": 0,
          "MaximumBuffers": 128,
          "MinimumBuffers": 28,
          "NumberOfBuffers": 30,
          "RealTimeBuffersLost": 0,
          "RestartCounter": 0
        },
        "Pktmon": {
          "IgnoredComponentEvents": 0,
          "IrrelevantEvents": 0,
          "ProccessedEvents": 16144,
          "ProccessedEventsFailure": 0,
          "ProccessedEventsPayloadOutOfBounds": 0,
          "ProcessedEventFailureMessage": "",
          "RejectedEvents": 0,
          "ThrottledEvents": 0
        },
        "WinsockAfd": {
          "EmptyAddressEvents": 0,
          "EmptyPortEvents": 332,
          "FilteredAddressEvents": 4,
          "ProccessedEvents": 74494,
          "ProccessedEventsFailure": 0,
          "ProcessedEventFailureMessage": ""
        }
      },
      "EventSender": {
        "HandlersStatistics": [
          {
            "SenseNdrSsdpEvent": {
              "EventsSentCount": 0,
              "EventsToSendCount": 0,
              "ExtraInfo": null
            }
          },
          {
            "SenseNdrMdnsEvent": {
              "EventsSentCount": 0,
              "EventsToSendCount": 0,
              "ExtraInfo": null
            }
          },
          {
            "SenseNdrArpEvent": {
              "EventsSentCount": 1384,
              "EventsToSendCount": 1384,
              "ExtraInfo": null
            }
          },
          {
            "SenseNdrCdpEvent": {
              "EventsSentCount": 0,
              "EventsToSendCount": 0,
              "ExtraInfo": null
            }
          },
          {
            "SenseNdrDhcpEvent": {
              "EventsSentCount": 0,
              "EventsToSendCount": 0,
              "ExtraInfo": null
            }
          },
          {
            "SenseNdrNbnsEvent": {
              "EventsSentCount": 4,
              "EventsToSendCount": 4,
              "ExtraInfo": null
            }
          },
          {
            "SenseNdrDhcpV6Event": {
              "EventsSentCount": 0,
              "EventsToSendCount": 0,
              "ExtraInfo": null
            }
          },
          {
            "SenseNdrLldpEvent": {
              "EventsSentCount": 1,
              "EventsToSendCount": 1,
              "ExtraInfo": null
            }
          },
          {
            "SenseNdrLlmnrEvent": {
              "EventsSentCount": 0,
              "EventsToSendCount": 0,
              "ExtraInfo": null
            }
          },
          {
            "SenseNdrMndpEvent": {
              "EventsSentCount": 0,
              "EventsToSendCount": 0,
              "ExtraInfo": null
            }
          },
          {
            "SenseNdrTcpHeaderEvent": {
              "EventsSentCount": 498,
              "EventsToSendCount": 498,
              "ExtraInfo": null
            }
          },
          {
            "SenseNdrWsdEvent": {
              "EventsSentCount": 0,
              "EventsToSendCount": 0,
              "ExtraInfo": null
            }
          },
          {
            "SenseNdrSignatureEvent": {
              "EventsSentCount": 92,
              "EventsToSendCount": 92,
              "ExtraInfo": null
            }
          },
          {
            "SenseNdrUdpHeaderEvent": {
              "EventsSentCount": 607,
              "EventsToSendCount": 607,
              "ExtraInfo": null
            }
          },
          {
            "SenseNdrIPHeaderEvent": {
              "EventsSentCount": 0,
              "EventsToSendCount": 0,
              "ExtraInfo": null
            }
          }
        ],
        "PropertyMapsReceived": 2586,
        "UnknownPropertyMapsReceived": 0
      },
      "IpcUnixSocketEnabled": false,
      "MemoryAllocation": {
        "PktmonInfoQueue": {
          "AllocatedMemorySize": 0,
          "ItemCount": 0
        },
        "ProcessToSocket": {
          "ConnectionMapping": {
            "AllocatedMemorySize": 58073,
            "ItemCount": 995
          },
          "LruCache": {
            "AllocatedMemorySize": 82831,
            "ItemCount": 1007
          },
          "ProcessMapping": {
            "AllocatedMemorySize": 16112,
            "ItemCount": 1007
          }
        },
        "PropMapQueue": {
          "AllocatedMemorySize": 0,
          "ItemCount": 0
        },
        "ZeekQueue": {
          "AllocatedMemorySize": 0,
          "ItemCount": 0
        }
      },
      "Orchestrator": [
        "DroppedMapEvent",
        0
      ],
      "PacketParser": {
        "Dissectors": [
          {
            "SenseNdrSignatureEvent": {
              "ExtraInfo": {
                "SignaturesTelemetries": [
                  {
                    "ReceivedPackets": 3,
                    "SignatureName": "MS-Browser"
                  },
                  {
                    "ReceivedPackets": 0,
                    "SignatureName": "IPHONE_SYNC"
                  },
                  {
                    "ReceivedPackets": 0,
                    "SignatureName": "NTLM-Challenge"
                  },
                  {
                    "ReceivedPackets": 0,
                    "SignatureName": "HttpServerHeader"
                  },
                  {
                    "ReceivedPackets": 50,
                    "SignatureName": "SMB_Client"
                  },
                  {
                    "ReceivedPackets": 39,
                    "SignatureName": "HTTP_Client"
                  },
                  {
                    "ReceivedPackets": 0,
                    "SignatureName": "CVE-2021-44228"
                  },
                  {
                    "ReceivedPackets": 0,
                    "SignatureName": "JavaReferenceOverLdap"
                  },
                  {
                    "ReceivedPackets": 0,
                    "SignatureName": "Java_RMI"
                  },
                  {
                    "ReceivedPackets": 0,
                    "SignatureName": "HTTP_RequestBodyParameters"
                  },
                  {
                    "ReceivedPackets": 0,
                    "SignatureName": "DNS_Request"
                  },
                  {
                    "ReceivedPackets": 0,
                    "SignatureName": "TCP_RiskIQPublicIpScan"
                  },
                  {
                    "ReceivedPackets": 0,
                    "SignatureName": "UDP_RiskIQPublicIpScan"
                  },
                  {
                    "ReceivedPackets": 0,
                    "SignatureName": "SMB_SRVSVC"
                  },
                  {
                    "ReceivedPackets": 0,
                    "SignatureName": "WakeOnLan"
                  },
                  {
                    "ReceivedPackets": 0,
                    "SignatureName": "Spring4Shell"
                  },
                  {
                    "ReceivedPackets": 0,
                    "SignatureName": "Kerberos_TGS_REQ"
                  },
                  {
                    "ReceivedPackets": 0,
                    "SignatureName": "LDAP_RBCD_Modify"
                  },
                  {
                    "ReceivedPackets": 0,
                    "SignatureName": "MS_MSDT"
                  },
                  {
                    "ReceivedPackets": 0,
                    "SignatureName": "NegoEx-ApReq"
                  },
                  {
                    "ReceivedPackets": 0,
                    "SignatureName": "PointOfCareTesting"
                  },
                  {
                    "ReceivedPackets": 0,
                    "SignatureName": "SMB_Server_Guid"
                  }
                ]
              },
              "FilteredOutputEvents": 0,
              "InputPackets": 16144,
              "OutputEvents": 92
            }
          },
          {
            "SenseNdrMndpEvent": {
              "ExtraInfo": {
                "ParseErrors": 0,
                "PartialParseErrors": 0
              },
              "FilteredOutputEvents": 0,
              "InputPackets": 0,
              "OutputEvents": 0
            }
          },
          {
            "SenseNdrMdnsEvent": {
              "ExtraInfo": {
                "OutOfBoundsErrorsCount": 0,
                "OutOfMemoryErrorsCount": 0
              },
              "FilteredOutputEvents": 0,
              "InputPackets": 0,
              "OutputEvents": 0
            }
          },
          {
            "SenseNdrDhcpEvent": {
              "ExtraInfo": {
                "JsonConversionErrors": 0,
                "PartialParseErrors": 0
              },
              "FilteredOutputEvents": 0,
              "InputPackets": 0,
              "OutputEvents": 0
            }
          },
          {
            "SenseNdrDhcpV6Event": {
              "ExtraInfo": {
                "PartialParseErrors": 0
              },
              "FilteredOutputEvents": 0,
              "InputPackets": 0,
              "OutputEvents": 0
            }
          },
          {
            "SenseNdrCdpEvent": {
              "ExtraInfo": {
                "OtherParsingErrors": 0,
                "TruncatedPackets": 0
              },
              "FilteredOutputEvents": 0,
              "InputPackets": 0,
              "OutputEvents": 0
            }
          },
          {
            "SenseNdrLlmnrEvent": {
              "ExtraInfo": {
                "PartialParseErrors": 0
              },
              "FilteredOutputEvents": 0,
              "InputPackets": 0,
              "OutputEvents": 0
            }
          },
          {
            "SenseNdrLldpEvent": {
              "ExtraInfo": {
                "PartialParseErrors": 0
              },
              "FilteredOutputEvents": 0,
              "InputPackets": 1,
              "OutputEvents": 1
            }
          },
          {
            "SenseNdrArpEvent": {
              "ExtraInfo": {
                "ProbArpPackets": 0,
                "TruncatedPackets": 0
              },
              "FilteredOutputEvents": 0,
              "InputPackets": 1384,
              "OutputEvents": 1384
            }
          },
          {
            "SenseNdrSsdpEvent": {
              "ExtraInfo": {
                "JsonConversionErrors": 0
              },
              "FilteredOutputEvents": 0,
              "InputPackets": 0,
              "OutputEvents": 0
            }
          },
          {
            "SenseNdrNbnsEvent": {
              "ExtraInfo": {
                "FlagMaxNodeNamesLength": 0,
                "FlagNameRequestParseError": 0,
                "FlagNegativeQueryResponse": 0,
                "FlagNodeStatusRequest": 0,
                "FlagNotParsed": 0,
                "FlagPositiveQueryResponseError": 0,
                "FlagRedirectNameQuery": 0,
                "FlagWaitForAcknowledgment": 0,
                "LastFlagNotParsed": 65535
              },
              "FilteredOutputEvents": 0,
              "InputPackets": 8,
              "OutputEvents": 8
            }
          },
          {
            "SenseNdrTcpHeaderEvent": {
              "ExtraInfo": null,
              "FilteredOutputEvents": 0,
              "InputPackets": 498,
              "OutputEvents": 498
            }
          },
          {
            "SenseNdrWsdEvent": {
              "ExtraInfo": {
                "Action not parsed": 0
              },
              "FilteredOutputEvents": 0,
              "InputPackets": 0,
              "OutputEvents": 0
            }
          },
          {
            "SenseNdrUdpHeaderEvent": {
              "ExtraInfo": {
                "TruncatedPackets": 0
              },
              "FilteredOutputEvents": 0,
              "InputPackets": 1285,
              "OutputEvents": 1285
            }
          },
          {
            "SenseNdrIPHeaderEvent": {
              "ExtraInfo": {
                "TruncatedPackets": 0
              },
              "FilteredOutputEvents": 0,
              "InputPackets": 120,
              "OutputEvents": 120
            }
          }
        ],
        "Layer3PacketsCreated": 1505,
        "PktMonInfoReceived": 16144,
        "PktMonInfoReceivedUnexpectedType": 0,
        "PropMapsFromLayer3": 1385,
        "PropMapsFromTcp": 587,
        "PropMapsFromUdp": 614,
        "SampleTotalTicks": 1800015,
        "TcpPacketsCreated": 13354,
        "UdpPacketsCreated": 1285,
        "WorkTicks": 2656250
      },
      "PerformanceMonitor": {
        "CPUMonitor_SenseNDR": {
          "avgSample": 0.0350625249022568,
          "maximumSample": 0.9413095572979955,
          "minimumSample": 0.0,
          "probingCounter": 895
        },
        "MemoryMonitor_SenseNDR": {
          "avgSample": 85496416.6793296,
          "maximumSample": 98283520.0,
          "minimumSample": 85008384.0,
          "probingCounter": 895
        },
        "NpPoolMonitor_SenseNDR": {
          "avgSample": 90058125.22011173,
          "maximumSample": 95426936.0,
          "minimumSample": 85401660.0,
          "probingCounter": 895
        }
      },
      "ProcessName": "SenseNdr.exe",
      "Throttling": {
        "CPUMonitor_Throttling": {
          "Current Limit": 1000000,
          "Current Sample": 0.0,
          "Current Step": 0,
          "Lower Threshold": 3.0,
          "Steps Count": 8,
          "Upper Threshold": 5.0
        },
        "MemoryMonitor_Throttling": {
          "Current Limit": 1000000,
          "Current Sample": 86929408.0,
          "Current Step": 0,
          "Lower Threshold": 94371840.0,
          "Steps Count": 2,
          "Upper Threshold": 104857600.0
        },
        "NpPoolMonitor_Throttling": {
          "Current Limit": 1000000,
          "Current Sample": 95410400.0,
          "Current Step": 0,
          "Lower Threshold": 94371840.0,
          "Steps Count": 2,
          "Upper Threshold": 104857600.0
        }
      },
      "Uptime": 39600,
      "Version": "4.0.0.15",
      "ZeekRunner": {
        "ConnStats": {
          "CumulativeIcmpConns": 8,
          "CumulativeTcpConns": 4031,
          "CumulativeUdpConns": 2301,
          "CurrentConnections": 7,
          "CurrentSessions": 7,
          "ExpiredByInactivity": 431,
          "MaxFragments": 0,
          "MaxIcmpConns": 3,
          "MaxTcpConns": 90,
          "MaxUdpConns": 26,
          "NumFragments": 0,
          "NumIcmpConns": 1,
          "NumPackets": 182179,
          "NumTcpConns": 3,
          "NumUdpConns": 3,
          "TotalConnections": 6340
        },
        "MemoryAllocation": {
          "ConnectionStore": {
            "AllocatedMemorySize": 611818,
            "ItemCount": 2450
          }
        },
        "NumZeekThreads": 16,
        "ThreadCpuTicks": 35625000
      },
      "ZeekScriptsMetadata": [
        {
          "PolicyName": "SenseNdrZeekScriptsPolicy_Core",
          "PolicyVersion": "20260428.1"
        }
      ]
    },
    "TelemetryName": "SenseNdrStatistics",
    "TelemetryTimestamp": 134291395171225349
  },
  "message": ""
}

ntlm

Level: 4

Fields #

Name	Description
`AdapterDefaultGateways`
`AdapterDefaultGatewaysMac`
`AdapterIpAddresses`
`AdapterMac`
`DstMac`
`FirstPacketId`
`IsOutgoingPacket`
`MacExtractor`
`NdrProcess`
`NdrVersion`
`NetworkAdapterId`
`NetworkCategory`
`NetworkDomainType`
`NetworkName`
`NetworkNamesFromRegistry`
`PacketTimestamp`
`ProcessId`
`ProcessStartKey`
`SessionDirection`
`SrcMac`
`challenge`
`domainname`
`hostname`
`id.orig_h`
`id.orig_p`
`id.resp_h`
`id.resp_p`
`negotiate_seal`
`negotiate_sign`
`server_dns_computer_name`
`server_dns_domain_name`
`server_nb_computer_name`
`server_nb_domain_name`
`server_target_name`
`server_tree_name`
`server_version`
`success`
`ts`
`uid`
`username`
`version`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1580,
      "thread_id": 6832
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Sense.Ndr",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 19:05:21.561Z",
    "version": 0
  },
  "event_data": {
    "AdapterDefaultGateways": "10.2.10.254",
    "AdapterDefaultGatewaysMac": "bc:24:11:22:5b:57",
    "AdapterIpAddresses": "10.2.10.21/24",
    "AdapterMac": "bc:24:11:9a:4d:c2",
    "DstMac": "bc:24:11:41:f2:58",
    "FirstPacketId": "{7DBEF867-77F9-47A3-9E6E-B2967DCF3248}",
    "IsOutgoingPacket": true,
    "MacExtractor": "Zeek",
    "NdrProcess": "SenseNdr.exe",
    "NdrVersion": "4.0.0.15",
    "NetworkAdapterId": "{8A1760B6-DC99-4B90-9C4A-029698E5AE27}",
    "NetworkCategory": 2,
    "NetworkDomainType": 2,
    "NetworkName": "ludus.domain",
    "NetworkNamesFromRegistry": "ludus.domain",
    "PacketTimestamp": 134291343191417549,
    "ProcessId": 4294967295,
    "ProcessStartKey": 0,
    "SessionDirection": "Out",
    "SrcMac": "bc:24:11:9a:4d:c2",
    "challenge": "11a4423518ce92",
    "domainname": "<Zeek-Unset>",
    "hostname": "JD-WIN11-22H2-1",
    "id.orig_h": "10.2.10.21",
    "id.orig_p": "57701",
    "id.resp_h": "10.2.10.11",
    "id.resp_p": "445",
    "negotiate_seal": "false",
    "negotiate_sign": "true",
    "server_dns_computer_name": "JD-DC01-2022.ludus.domain",
    "server_dns_domain_name": "ludus.domain",
    "server_nb_computer_name": "JD-DC01-2022",
    "server_nb_domain_name": "ludus",
    "server_target_name": "<Zeek-Unset>",
    "server_tree_name": "ludus.domain",
    "server_version": "10.0 20348 15",
    "success": "true",
    "ts": "134291343191521800",
    "uid": "CrGfpROX0TgBRe9T3",
    "username": "<Zeek-Unset>",
    "version": "10.0 22621 15"
  },
  "message": ""
}

SenseNdrIPHeaderEvent

Level: 4

Fields #

Name	Description
`AdapterDefaultGateways`
`AdapterDefaultGatewaysMac`
`AdapterIpAddresses`
`AdapterMac`
`DestIp`
`DstMac`
`IsOutgoingPacket`
`NdrProcess`
`NdrVersion`
`NetworkAdapterId`
`NetworkCategory`
`NetworkDomainType`
`NetworkName`
`NetworkNamesFromRegistry`
`PacketTimestamp`
`ProcessId`
`ProcessStartKey`
`Protocol`
`SrcIp`
`SrcMac`
`Ttl`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1580,
      "thread_id": 7752
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Sense.Ndr",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 19:05:27.601Z",
    "version": 0
  },
  "event_data": {
    "AdapterDefaultGateways": "10.2.10.254",
    "AdapterDefaultGatewaysMac": "bc:24:11:22:5b:57",
    "AdapterIpAddresses": "10.2.10.21/24",
    "AdapterMac": "bc:24:11:9a:4d:c2",
    "DestIp": "10.2.10.11",
    "DstMac": "bc:24:11:41:f2:58",
    "IsOutgoingPacket": true,
    "NdrProcess": "SenseNdr.exe",
    "NdrVersion": "4.0.0.15",
    "NetworkAdapterId": "{8A1760B6-DC99-4B90-9C4A-029698E5AE27}",
    "NetworkCategory": 2,
    "NetworkDomainType": 2,
    "NetworkName": "ludus.domain",
    "NetworkNamesFromRegistry": "ludus.domain",
    "PacketTimestamp": 134291343235818784,
    "ProcessId": 4294967295,
    "ProcessStartKey": 0,
    "Protocol": 1,
    "SrcIp": "10.2.10.21",
    "SrcMac": "bc:24:11:9a:4d:c2",
    "Ttl": 128
  },
  "message": ""
}

SenseNdrSignatureEvent

Level: 4

Fields #

Name	Description
`AdapterDefaultGateways`
`AdapterDefaultGatewaysMac`
`AdapterIpAddresses`
`AdapterMac`
`DstIp`
`DstMac`
`DstPort`
`FirstSeenBytes`
`IpTTL`
`IsOutgoingPacket`
`NdrProcess`
`NdrVersion`
`NetworkAdapterId`
`NetworkCategory`
`NetworkDomainType`
`NetworkName`
`NetworkNamesFromRegistry`
`PacketTimestamp`
`PayloadBytes`
`PayloadSize`
`ProcessId`
`ProcessStartKey`
`SignatureBytes`
`SignatureName`
`SrcIp`
`SrcMac`
`SrcPort`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1580,
      "thread_id": 7752
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Sense.Ndr",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:50:12.470Z",
    "version": 0
  },
  "event_data": {
    "AdapterDefaultGateways": "10.2.10.254",
    "AdapterDefaultGatewaysMac": "bc:24:11:22:5b:57",
    "AdapterIpAddresses": "10.2.10.21/24",
    "AdapterMac": "bc:24:11:9a:4d:c2",
    "DstIp": "172.66.147.243",
    "DstMac": "bc:24:11:22:5b:57",
    "DstPort": 80,
    "FirstSeenBytes": [
      "GET /1 HTTP/1.1%0D%0AUser-Agent: Mozilla/5.0 (Windows "
    ],
    "IpTTL": 128,
    "IsOutgoingPacket": true,
    "NdrProcess": "SenseNdr.exe",
    "NdrVersion": "4.0.0.15",
    "NetworkAdapterId": "{8A1760B6-DC99-4B90-9C4A-029698E5AE27}",
    "NetworkCategory": 2,
    "NetworkDomainType": 2,
    "NetworkName": "ludus.domain",
    "NetworkNamesFromRegistry": "ludus.domain",
    "PacketTimestamp": 134291334089369162,
    "PayloadBytes": [
      "GET /1 HTTP/1.1%0D%0AUser-Agent: Mozilla/5.0 (Windows "
    ],
    "PayloadSize": 157,
    "ProcessId": 1176,
    "ProcessStartKey": 9288674231461491,
    "SignatureBytes": "GET /1 HTTP/1.1",
    "SignatureName": "HTTP_Client",
    "SrcIp": "10.2.10.21",
    "SrcMac": "bc:24:11:9a:4d:c2",
    "SrcPort": 57580
  },
  "message": ""
}

SenseNdrUdpHeaderEvent

Level: 4

Fields #

Name	Description
`AdapterDefaultGateways`
`AdapterDefaultGatewaysMac`
`AdapterIpAddresses`
`AdapterMac`
`DestIp`
`DestPort`
`DstMac`
`IsOutgoingPacket`
`NdrProcess`
`NdrVersion`
`NetworkAdapterId`
`NetworkCategory`
`NetworkDomainType`
`NetworkName`
`NetworkNamesFromRegistry`
`PacketTimestamp`
`PayloadLength`
`ProcessId`
`ProcessStartKey`
`SrcIp`
`SrcMac`
`SrcPort`
`Ttl`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1580,
      "thread_id": 7752
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Sense.Ndr",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:50:12.469Z",
    "version": 0
  },
  "event_data": {
    "AdapterDefaultGateways": "10.2.10.254",
    "AdapterDefaultGatewaysMac": "bc:24:11:22:5b:57",
    "AdapterIpAddresses": "10.2.10.21/24",
    "AdapterMac": "bc:24:11:9a:4d:c2",
    "DestIp": "10.2.10.11",
    "DestPort": 53,
    "DstMac": "bc:24:11:41:f2:58",
    "IsOutgoingPacket": true,
    "NdrProcess": "SenseNdr.exe",
    "NdrVersion": "4.0.0.15",
    "NetworkAdapterId": "{8A1760B6-DC99-4B90-9C4A-029698E5AE27}",
    "NetworkCategory": 2,
    "NetworkDomainType": 2,
    "NetworkName": "ludus.domain",
    "NetworkNamesFromRegistry": "ludus.domain",
    "PacketTimestamp": 134291334088850963,
    "PayloadLength": 37,
    "ProcessId": 2024,
    "ProcessStartKey": 9288674231451683,
    "SrcIp": "10.2.10.21",
    "SrcMac": "bc:24:11:9a:4d:c2",
    "SrcPort": 60830,
    "Ttl": 128
  },
  "message": ""
}

kerberos

Level: 4

Fields #

Name	Description
`AdapterDefaultGateways`
`AdapterDefaultGatewaysMac`
`AdapterIpAddresses`
`AdapterMac`
`DstMac`
`FirstPacketId`
`IsOutgoingPacket`
`MacExtractor`
`NdrProcess`
`NdrVersion`
`NetworkAdapterId`
`NetworkCategory`
`NetworkDomainType`
`NetworkName`
`NetworkNamesFromRegistry`
`PacketTimestamp`
`ProcessId`
`ProcessStartKey`
`SessionDirection`
`SrcMac`
`allow_postdate`
`auth_ticket`
`cipher`
`client`
`client_cert_fuid`
`client_cert_subject`
`error_msg`
`forwardable`
`forwarded`
`from`
`id.orig_h`
`id.orig_p`
`id.resp_h`
`id.resp_p`
`new_ticket`
`postdated`
`proxiable`
`proxy`
`renew`
`renewable`
`renewable_ok`
`request_type`
`server_cert_fuid`
`server_cert_subject`
`service`
`success`
`till`
`ts`
`uid`
`validate`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1580,
      "thread_id": 8824
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Sense.Ndr",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:50:40.557Z",
    "version": 0
  },
  "event_data": {
    "AdapterDefaultGateways": "10.2.10.254",
    "AdapterDefaultGatewaysMac": "bc:24:11:22:5b:57",
    "AdapterIpAddresses": "10.2.10.21/24",
    "AdapterMac": "bc:24:11:9a:4d:c2",
    "DstMac": "bc:24:11:41:f2:58",
    "FirstPacketId": "{5492700E-A4E4-4389-8D6F-380AEF318CCD}",
    "IsOutgoingPacket": true,
    "MacExtractor": "Zeek",
    "NdrProcess": "SenseNdr.exe",
    "NdrVersion": "4.0.0.15",
    "NetworkAdapterId": "{8A1760B6-DC99-4B90-9C4A-029698E5AE27}",
    "NetworkCategory": 2,
    "NetworkDomainType": 2,
    "NetworkName": "ludus.domain",
    "NetworkNamesFromRegistry": "ludus.domain",
    "PacketTimestamp": 134291334361221457,
    "ProcessId": 4294967295,
    "ProcessStartKey": 0,
    "SessionDirection": "Out",
    "SrcMac": "bc:24:11:9a:4d:c2",
    "allow_postdate": "<Zeek-Unset>",
    "auth_ticket": "8ed4a11e62a63c2b7f27cc6a995c9dc51c2fbe115fa49cd3f1c26807f44bf558",
    "cipher": "aes256-cts-hmac-sha1-96",
    "client": "<Zeek-Unset>",
    "client_cert_fuid": "<Zeek-Unset>",
    "client_cert_subject": "<Zeek-Unset>",
    "error_msg": "<Zeek-Unset>",
    "forwardable": "<Zeek-Unset>",
    "forwarded": "<Zeek-Unset>",
    "from": "<Zeek-Unset>",
    "id.orig_h": "10.2.10.21",
    "id.orig_p": "57591",
    "id.resp_h": "10.2.10.11",
    "id.resp_p": "445",
    "new_ticket": "<Zeek-Unset>",
    "postdated": "<Zeek-Unset>",
    "proxiable": "<Zeek-Unset>",
    "proxy": "<Zeek-Unset>",
    "renew": "<Zeek-Unset>",
    "renewable": "<Zeek-Unset>",
    "renewable_ok": "<Zeek-Unset>",
    "request_type": "AP",
    "server_cert_fuid": "<Zeek-Unset>",
    "server_cert_subject": "<Zeek-Unset>",
    "service": "cifs/JD-DC01-2022.ludus.domain/LUDUS.DOMAIN",
    "success": "true",
    "till": "<Zeek-Unset>",
    "ts": "134291334361291090",
    "uid": "C0DamZ2tgQWBpW5q6f",
    "validate": "<Zeek-Unset>"
  },
  "message": ""
}

SenseNdrNbnsEvent

Level: 4

Fields #

Name	Description
`AdapterDefaultGateways`
`AdapterDefaultGatewaysMac`
`AdapterIpAddresses`
`AdapterMac`
`DestIp`
`DstMac`
`Flags`
`IsOutgoingPacket`
`NbFlags`
`NdrProcess`
`NdrVersion`
`NetworkAdapterId`
`NetworkCategory`
`NetworkDomainType`
`NetworkName`
`NetworkNamesFromRegistry`
`PacketTimestamp`
`ProcessId`
`ProcessStartKey`
`QueryName`
`QueryType`
`RRAddr`
`RRName`
`RRNodeNames`
`RRTtl`
`RRType`
`RRUnitID`
`SrcIp`
`SrcMAC`
`TransactionId`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1580,
      "thread_id": 7752
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Sense.Ndr",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 20:44:36.213Z",
    "version": 0
  },
  "event_data": {
    "AdapterDefaultGateways": "10.2.10.254",
    "AdapterDefaultGatewaysMac": "bc:24:11:22:5b:57",
    "AdapterIpAddresses": "10.2.10.21/24",
    "AdapterMac": "bc:24:11:9a:4d:c2",
    "DestIp": "10.2.10.255",
    "DstMac": "ff:ff:ff:ff:ff:ff",
    "Flags": 272,
    "IsOutgoingPacket": true,
    "NbFlags": 65535,
    "NdrProcess": "SenseNdr.exe",
    "NdrVersion": "4.0.0.15",
    "NetworkAdapterId": "{8A1760B6-DC99-4B90-9C4A-029698E5AE27}",
    "NetworkCategory": 2,
    "NetworkDomainType": 2,
    "NetworkName": "ludus.domain",
    "NetworkNamesFromRegistry": "ludus.domain",
    "PacketTimestamp": 134291402724807590,
    "ProcessId": 4294967295,
    "ProcessStartKey": 0,
    "QueryName": "EKEECNEEEDDADBCNDCDADCDCCACACAAA",
    "QueryType": 32,
    "RRAddr": "",
    "RRName": "",
    "RRNodeNames": "",
    "RRTtl": 4294967295,
    "RRType": 65535,
    "RRUnitID": "",
    "SrcIp": "10.2.10.21",
    "SrcMAC": "bc:24:11:9a:4d:c2",
    "TransactionId": 35396
  },
  "message": ""
}

ssl

Level: 4

Fields #

Name	Description
`AdapterDefaultGateways`
`AdapterDefaultGatewaysMac`
`AdapterIpAddresses`
`AdapterMac`
`DstMac`
`FirstPacketId`
`IsOutgoingPacket`
`MacExtractor`
`NdrProcess`
`NdrVersion`
`NetworkAdapterId`
`NetworkCategory`
`NetworkDomainType`
`NetworkName`
`NetworkNamesFromRegistry`
`PacketTimestamp`
`ProcessId`
`ProcessStartKey`
`SessionDirection`
`SrcMac`
`cert_chain_fps`
`cipher`
`client_cert_chain_fps`
`client_issuer`
`client_subject`
`curve`
`established`
`id.orig_h`
`id.orig_p`
`id.resp_h`
`id.resp_p`
`issuer`
`ja3`
`ja3s`
`ja4`
`ja4_o`
`ja4_r`
`ja4_ro`
`ja4s`
`ja4s_r`
`last_alert`
`next_protocol`
`resumed`
`server_name`
`sni_matches_cert`
`ssl_history`
`subject`
`ts`
`uid`
`version`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1580,
      "thread_id": 10172
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Sense.Ndr",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:50:04.430Z",
    "version": 0
  },
  "event_data": {
    "AdapterDefaultGateways": "10.2.10.254",
    "AdapterDefaultGatewaysMac": "bc:24:11:22:5b:57",
    "AdapterIpAddresses": "10.2.10.21/24",
    "AdapterMac": "bc:24:11:9a:4d:c2",
    "DstMac": "bc:24:11:9a:4d:c2",
    "FirstPacketId": "{57E91ECE-4593-434E-A33D-F7F387329A7C}",
    "IsOutgoingPacket": false,
    "MacExtractor": "Zeek",
    "NdrProcess": "SenseNdr.exe",
    "NdrVersion": "4.0.0.15",
    "NetworkAdapterId": "{8A1760B6-DC99-4B90-9C4A-029698E5AE27}",
    "NetworkCategory": 2,
    "NetworkDomainType": 2,
    "NetworkName": "ludus.domain",
    "NetworkNamesFromRegistry": "ludus.domain",
    "PacketTimestamp": 134291334001603835,
    "ProcessId": 4294967295,
    "ProcessStartKey": 0,
    "SessionDirection": "In",
    "SrcMac": "bc:24:11:22:5b:57",
    "cert_chain_fps": "<Zeek-Unset>",
    "cipher": "TLS_AES_256_GCM_SHA384",
    "client_cert_chain_fps": "<Zeek-Unset>",
    "client_issuer": "<Zeek-Unset>",
    "client_subject": "<Zeek-Unset>",
    "curve": "x25519",
    "established": "true",
    "id.orig_h": "10.2.20.61",
    "id.orig_p": "35284",
    "id.resp_h": "10.2.10.21",
    "id.resp_p": "5986",
    "issuer": "<Zeek-Unset>",
    "ja3": "f80d3d09f61892c5846c854dd84ac403",
    "ja3s": "15af977ce25de452b96affa2addb1036",
    "ja4": "t13i4311h1_c7886603b240_b26ce05bbdd6",
    "ja4_o": "t13i4311h1_b7bf452c9920_816d91d437ed",
    "ja4_r": "t13i4311h1_002f,0033,0035,0039,003c,003d,0067,006b,009c,009d,009e,009f,00ff,1301,1302,1303,c009,c00a,c013,c014,c023,c024,c027,c028,c02b,c02c,c02f,c030,c09c,c09d,c09e,c09f,c0a0,c0a1,c0a2,c0a3,c0ac,c0ad,c0ae,c0af,cca8,cca9,ccaa_000a,000b,000d,0015,0016,0017,002b,002d,0031,0033_0403,0503,0603,0807,0808,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0301,0302,0402,0502,0602",
    "ja4_ro": "t13i4311h1_1302,1303,1301,c02c,c030,c02b,c02f,cca9,cca8,009f,009e,ccaa,c0af,c0ad,c0ae,c0ac,c024,c028,c023,c027,c00a,c014,c009,c013,c0a3,c09f,c0a2,c09e,006b,0067,0039,0033,009d,009c,c0a1,c09d,c0a0,c09c,003d,003c,0035,002f,00ff_000b,000a,0010,0016,0017,0031,000d,002b,002d,0033,0015_0403,0503,0603,0807,0808,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0301,0302,0402,0502,0602",
    "ja4s": "t120200_1302_a56c5b993250",
    "ja4s_r": "t120200_1302_002b,0033",
    "last_alert": "<Zeek-Unset>",
    "next_protocol": "<Zeek-Unset>",
    "resumed": "false",
    "server_name": "<Zeek-Unset>",
    "sni_matches_cert": "<Zeek-Unset>",
    "ssl_history": "CsiI",
    "subject": "<Zeek-Unset>",
    "ts": "134291334002067820",
    "uid": "CIqq6P1asdWsrUYI28",
    "version": "TLSv13"
  },
  "message": ""
}

SenseNdrTcpHeaderEvent

Level: 4

Fields #

Name	Description
`AckNum`
`AdapterDefaultGateways`
`AdapterDefaultGatewaysMac`
`AdapterIpAddresses`
`AdapterMac`
`DFdata`
`DestIp`
`DestPort`
`DstMac`
`IpHeaderSize`
`IpId`
`IsOutgoingPacket`
`NdrProcess`
`NdrVersion`
`NetworkAdapterId`
`NetworkCategory`
`NetworkDomainType`
`NetworkName`
`NetworkNamesFromRegistry`
`PacketSize`
`PacketTimestamp`
`ProcessId`
`ProcessStartKey`
`SeqNum`
`SrcIp`
`SrcMac`
`SrcPort`
`TcpFlags`
`TcpHeaderSize`
`TcpOptions`
`TcpWindowSize`
`Tos`
`Ttl`
`UrgentPointer`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1580,
      "thread_id": 7752
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Sense.Ndr",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:50:04.422Z",
    "version": 0
  },
  "event_data": {
    "AckNum": 0,
    "AdapterDefaultGateways": "10.2.10.254",
    "AdapterDefaultGatewaysMac": "bc:24:11:22:5b:57",
    "AdapterIpAddresses": "10.2.10.21/24",
    "AdapterMac": "bc:24:11:9a:4d:c2",
    "DFdata": 16384,
    "DestIp": "10.2.10.21",
    "DestPort": 5986,
    "DstMac": "bc:24:11:9a:4d:c2",
    "IpHeaderSize": 20,
    "IpId": 43012,
    "IsOutgoingPacket": false,
    "NdrProcess": "SenseNdr.exe",
    "NdrVersion": "4.0.0.15",
    "NetworkAdapterId": "{8A1760B6-DC99-4B90-9C4A-029698E5AE27}",
    "NetworkCategory": 2,
    "NetworkDomainType": 2,
    "NetworkName": "ludus.domain",
    "NetworkNamesFromRegistry": "ludus.domain",
    "PacketSize": 74,
    "PacketTimestamp": 134291334001603835,
    "ProcessId": 4294967295,
    "ProcessStartKey": 0,
    "SeqNum": 63830982,
    "SrcIp": "10.2.20.61",
    "SrcMac": "bc:24:11:22:5b:57",
    "SrcPort": 35284,
    "TcpFlags": 2,
    "TcpHeaderSize": 40,
    "TcpOptions": "020405B40402080A90B20AC20000000001030307",
    "TcpWindowSize": 64240,
    "Tos": 0,
    "Ttl": 63,
    "UrgentPointer": 0
  },
  "message": ""
}

dce_rpc

Level: 4

Fields #

Name	Description
`AdapterDefaultGateways`
`AdapterDefaultGatewaysMac`
`AdapterIpAddresses`
`AdapterMac`
`DstMac`
`FirstPacketId`
`IsOutgoingPacket`
`MacExtractor`
`NdrProcess`
`NdrVersion`
`NetworkAdapterId`
`NetworkCategory`
`NetworkDomainType`
`NetworkName`
`NetworkNamesFromRegistry`
`PacketTimestamp`
`ProcessId`
`ProcessStartKey`
`SessionDirection`
`SrcMac`
`endpoint`
`id.orig_h`
`id.orig_p`
`id.resp_h`
`id.resp_p`
`named_pipe`
`operation`
`rtt`
`ts`
`uid`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1580,
      "thread_id": 10768
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Sense.Ndr",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:50:04.438Z",
    "version": 0
  },
  "event_data": {
    "AdapterDefaultGateways": "10.2.10.254",
    "AdapterDefaultGatewaysMac": "bc:24:11:22:5b:57",
    "AdapterIpAddresses": "10.2.10.21/24",
    "AdapterMac": "bc:24:11:9a:4d:c2",
    "DstMac": "bc:24:11:41:f2:58",
    "FirstPacketId": "{DEBCAB45-0662-4941-8DE7-8B48A7300315}",
    "IsOutgoingPacket": true,
    "MacExtractor": "Zeek",
    "NdrProcess": "SenseNdr.exe",
    "NdrVersion": "4.0.0.15",
    "NetworkAdapterId": "{8A1760B6-DC99-4B90-9C4A-029698E5AE27}",
    "NetworkCategory": 2,
    "NetworkDomainType": 2,
    "NetworkName": "ludus.domain",
    "NetworkNamesFromRegistry": "ludus.domain",
    "PacketTimestamp": 134291333266449555,
    "ProcessId": 1180,
    "ProcessStartKey": 9288674231451662,
    "SessionDirection": "Out",
    "SrcMac": "bc:24:11:9a:4d:c2",
    "endpoint": "netlogon",
    "id.orig_h": "10.2.10.21",
    "id.orig_p": "57573",
    "id.resp_h": "10.2.10.11",
    "id.resp_p": "53177",
    "named_pipe": "53177",
    "operation": "NetrLogonSamLogonWithFlags",
    "rtt": "0.0030128955841064453",
    "ts": "134291334002440970",
    "uid": "Cna7v8UPpzOZPXy3c"
  },
  "message": ""
}