Windows Events
The SMB redirector selected the connection initiated with the following parameters
Event ID 30830
Microsoft-Windows-SmbClient/Connectivity
Main fields
IP address
IP
Windows
IP
ELK
-
Microsoft Sentinel
-
QRadar
-
Splunk
-
Computer name
Computer
Windows
Computer
ELK
winlog.computer_name
Microsoft Sentinel
-
QRadar
-
Splunk
-
User name
Not selected
Important field
ServerName
Windows
Server name
ELK
winlog.event_data.ServerName
Microsoft Sentinel
-
QRadar
-
Splunk
-
Fields
| Windows Raw | Windows | ELK | Microsoft Sentinel | QRadar | Splunk |
|---|---|---|---|---|---|
| ServerName | Server name | winlog.event_data.ServerName | - | - | - |
| ConnectionType | Connection Type | winlog.event_data.ConnectionType | - | - | - |
| RemoteAddress | Remote Address | winlog.event_data.RemoteAddress | - | - | - |
| LocalAddress | Local Address | winlog.event_data.LocalAddress | - | - | - |
| InstanceName | Instance Name | winlog.event_data.InstanceName | - | - | - |
| PortSelectionOrigin | Port Origin | winlog.event_data.PortSelectionOrigin | - | - | - |
| Status | Error Code | winlog.event_data.Status | - | - | - |
| ConnectionId | Connection ID | - | - | - | - |
| ClientCertSha1Hash | Client certificate thumbprint | - | - | - | - |
| IP System field | IP System field | - | - | - | - |
| Computer System field | Computer System field | winlog.computer_name | - | - | - |
| ProcessID System field | ProcessID System field | winlog.process.pid | - | - | - |
| ThreadID System field | ThreadID System field | winlog.process.thread.id | - | - | - |
Sample Event
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-SMBClient" Guid="{988c59c5-0a1c-45b6-a555-0c62276e327d}" />
<EventID>30830</EventID>
<Version>2</Version>
<Level>4</Level>
<Task>111</Task>
<Opcode>0</Opcode>
<Keywords>0x400000000010000</Keywords>
<TimeCreated SystemTime="2026-08-02T14:45:56.5319982Z" />
<EventRecordID>697</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Microsoft-Windows-SmbClient/Connectivity</Channel>
<Computer>ADCS.socpedia.net</Computer>
<Security />
</System>
- <EventData>
<Data Name="ServerNameLength">13</Data>
<Data Name="ServerName">192.168.0.237</Data>
<Data Name="ConnectionType">1</Data>
<Data Name="RemoteAddressLength">16</Data>
<Data Name="RemoteAddress">020001BDC0A800ED0000000000000000</Data>
<Data Name="LocalAddressLength">0</Data>
<Data Name="LocalAddress" />
<Data Name="InstanceNameLength">24</Data>
<Data Name="InstanceName">\Device\LanmanRedirector</Data>
<Data Name="PortSelectionOrigin">4</Data>
<Data Name="Status">0x0</Data>
<Data Name="ConnectionIdSize">0</Data>
<Data Name="ConnectionId" />
<Data Name="ClientCertSha1HashSize">0</Data>
<Data Name="ClientCertSha1Hash" />
</EventData>
</Event>