# Suricata NTLM protocol detection

**URL:** <https://forum.suricata.io/t/suricata-ntlm-protocol-detection/4688>\
**Category:** Help\
**Tags:** suricata\
**Created:** [June 4, 2024, 3:11pm UTC](https://forum.suricata.io/t/suricata-ntlm-protocol-detection/4688 "2024-06-04T15:11:05Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![atbohmer](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/atbohmer/32/1853_2.png) [@atbohmer](https://forum.suricata.io/u/atbohmer)\
**Post date:** [June 4, 2024, 3:11pm UTC](https://forum.suricata.io/t/suricata-ntlm-protocol-detection/4688/1 "2024-06-04T15:11:05Z")

</div>

Hello,

Guess having a brain short circuit moment, but I had the idea suricata also detects ntlm version as a seperate protocol like tls, smb ?

Cheers  
Proud suricata beta 8 user 😉

---

<div class="post-metadata">

**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\
**Post date:** [July 31, 2024, 8:55pm UTC](https://forum.suricata.io/t/suricata-ntlm-protocol-detection/4688/2 "2024-07-31T20:55:27Z")

</div>

Currently not, there is no dedicated NTLM parser but NTLM related parts in smb.