22.214.171.124 Per SMB Session
Server.Session: An established session between the client and server. The following ADM elements are maintained for each SMB session established to a server:
Server.Session.Connection: The SMB connection associated with this session.
Server.Session.IsAnonymous: A Boolean that, if set, indicates that the session is for an anonymous user.
Server.Session.SessionKey: The 16-byte session key associated with this session, as obtained from the authentication packages after successful authentication.
Session.UID: The 2-byte UID for this session, representing the user that established the session. The UID is returned by the server in the SMB Header (section 126.96.36.199) of the session setup response. All subsequent SMB requests from the client for this user on this connection MUST use this UID.
There can be multiple UIDs generated per SMB connection, each representing a unique user.
Server.Session.UserSecurityContext: The security context of the user that established the session, as obtained from the authentication subsystem after successful authentication.
Server.Session.SessionGlobalId: A numeric 32-bit value obtained by registration with the Server Service Remote Protocol.
Server.Session.CreationTime: The time that the session was established.
Server.Session.IdleTime: The time that the session processed its most recent request.
Server.Session.UserName: The name of the user who established the session.