FTP Access Log

FTP Access Log

Base Rule

Information

Connection Information

EVID 1010 : Access Log FTP

Sub Rule

Information

General FTP Information

EVID 107 : Connecting To Primary Server

Sub Rule

Network Traffic

Connection Built

EVID 1080 : Creating Data Socket

Sub Rule

Network Traffic

Connection Built

EVID 1253 : STOR Command

Sub Rule

Information

General FTP Command

EVID 1526 : QUIT Command

Sub Rule

Information

General FTP Command

EVID 1629 : User Logged In

Sub Rule

Authentication Success

User Logon

EVID 498 : USER Command

Sub Rule

Information

General FTP Command

EVID 627 : PASS Command

Sub Rule

Information

General FTP Command

EVID 703 : TYPE Command

Sub Rule

Information

General FTP Command

EVID 782 : CWD Command

Sub Rule

Information

General FTP Command

Invalid Filename

Sub Rule

Error

FTP - 553 - Cmd Not Accepted - Invalid Filename

Requested File Action Aborted

Sub Rule

Error

FTP - 552 - Cmd Not Accepted - Allocation Exceeded

Page Type Unknown

Sub Rule

Error

FTP - 551 - Cmd Not Accepted - Page Type Unknown

File Unavailable

Sub Rule

Error

FTP - 550 - Cmd Not Accepted - File Unavailable

Need Account For Storing Files

Sub Rule

Error

FTP - 532 - Cmd Not Accepted - Need Account

User Not Logged In

Sub Rule

Access Failure

Command Execution Failure

Command Not Implemented For Parameter

Sub Rule

Warning

FTP - 504 - Cmd Not Accepted - Invalid Parameter

Bad Sequence Of Commands

Sub Rule

Error

FTP - 503 - Cmd Not Accepted - Bad Sequence

Command Not Implemented - ERRR

Sub Rule

Error

FTP - 502 - Cmd Not Accepted - Not Implemented

Syntax Error In Parameters Or Arguments

Sub Rule

Reconnaissance

Reconnaissance Activity

Syntax Error : Command Unrecognized

Sub Rule

Error

FTP - 500 - Cmd Not Accepted - Error In Command

Requested Action Not Taken

Sub Rule

Error

FTP - 452 - Cmd Not Accepted - Insufficient Space

Requested Action Aborted

Sub Rule

Error

FTP - 451 - Cmd Not Accepted - Action Aborted

Requested File Action Not Taken

Sub Rule

Error

FTP - 450 - Cmd Not Accepted - Action Not Taken

Host Unavailable

Sub Rule

Error

FTP - 434 - Cmd Not Accepted - Host Unavailable

Connection Closed : Transfer Aborted

Sub Rule

Error

FTP - 426 - Cmd Not Accepted - Connection Closed

Cant Open Data Connection

Sub Rule

Error

FTP - 425 - Cmd Not Accepted - Cant Open Conn

Service Not Available

Sub Rule

Error

FTP - 421 - Cmd Not Accepted - Service Unavailable

Requested File Action Pending

Sub Rule

Information

FTP - 350 - Cmd Ok - Action Pending

Need Account For Login

Sub Rule

Authentication Success

Authentication Activity

User Name Ok

Sub Rule

Authentication Success

Authentication Activity

Pathname Created

Sub Rule

Access Success

Object Created

Requested File Action Completed

Sub Rule

Access Success

Command Executed

Logout Noted

Sub Rule

Authentication Success

Authentication Activity

User Logged Out

Sub Rule

Authentication Success

User Logoff

User Logged In

Sub Rule

Authentication Success

User Logon

Extended Passive Mode

Sub Rule

Information

FTP - 229 - Cmd Success - Extended Passive Mode

Long Passive Mode

Sub Rule

Information

FTP - 228 - Cmd Success - Long Passive Mode

Entering Passive Mode

Sub Rule

Information

FTP - 227 - Completed Successfully - Passive Mode

Closing Data Connection

Sub Rule

Network Traffic

Connection Closed

Data Connection Open

Sub Rule

Network Traffic

Connection Built

Service Closing Control Connection

Sub Rule

Network Traffic

Connection Closed

Service Ready For New User

Sub Rule

Information

FTP - 220 - Completed Successfully - Service Ready

Name System Type

Sub Rule

Information

FTP - 215 - Completed Successfully - System Type

Help Message

Sub Rule

Information

FTP - 214 - Completed Succesfully - Help Message

File Status

Sub Rule

Information

FTP - 213 - Completed Successfully - File Status

Directory Status

Sub Rule

Information

FTP - 212 - Completed Successfully - Dir Status

System Status

Sub Rule

Information

FTP - 211 - Completed Successfully - System Status

Command Not Implemented - INFO

Sub Rule

Information

FTP - 202 - Completed Successfully - No Command

Command Okay

Sub Rule

Information

FTP - 200 - Completed Successfully - Command Ok

Open Data Connection

Sub Rule

Network Traffic

Connection Built

Transfer Starting

Sub Rule

Network Traffic

Transfer Started

Service Ready

Sub Rule

Information

FTP - 120 - Cmd Initiated - Service Ready

Restart Marker Reply

Sub Rule

Information

FTP - 100 - Command Initiated - Action Initiated

Transfer Starting

Sub Rule

Network Traffic

Transfer Started

N/A

<vmid>

Text/String/Number

N/A

<tag3>

Text/String/Number

N/A

<responsecode>

Number

N/A

<domainorigin>

Text/String

N/A

<dname>

Text/String

N/A

<dport>

Number

N/A

<login>

Text/String

N/A

<subject>

Text/String

N/A

<tag1>

Text/String

N/A

<command>

Text/String

N/A

<tag2>

Text/String

N/A

<dip>

Ip Address