Ports requirement for MS Exchange Integration with QRadar!

Hi All,
As per DSM QRadar supports SMTP, OWA and MSGTRK types of logs integration with MS Exchange. This integration need below ports to be enabled between QRadar and Exchange Server.

TCP port 13 for Microsoft Endpoint Mapper.
UDP port 137 for NetBIOS name service.
UDP port 138 for NetBIOS datagram service.
TCP port 139 for NetBIOS session service.
TCP port 445 for Microsoft Directory Services to transfer files across a Windows share.

I need to know why these multiple ports are required? What are the purposes of each in MS Exchange Integration?

BR,
Burhan

Related:

Extracting Identiy NetBIOS name with Ariel query?

I wrote a log source extension that stores the NetBIOS name in the Identity NetBIOS Name field of events.

What is the right way to get the data in this field from an Ariel query?

The documentation mentions that the identityNetBiosName field in Ariel has been replaced with the AssetHostname function. Is that the best way?

These events are on dynamic IP addresses that change hosts regularly, so I think I should use the time stamp field in the AssetHostname function. Should that be the event start time, stored time, or log source time?

How does this work on the Log Manager, which doesn’t have assets?

Should I just extract the NetBIOS name data to a custom property and use that?

I note that the (non-Advanced) event searches from the Log manager GUI can display these fields.

Related:

Event ID 4322 — NBT Connectivity

Event ID 4322 — NBT Connectivity

Updated: April 17, 2008

Applies To: Windows Server 2008

NBT (NetBIOS (network basic input/output system)) over TCP/IP (Transmission Control Protocol/Internet Protocol) connectivity facilitates file and printer sharing.

Event Details

Product: Windows Operating System
ID: 4322
Source: netbt
Version: 6.0
Symbolic Name: EVENT_NBT_NO_RESOURCES
Message: NetBT failed to process a request because it encountered OutOfResources exception(s) in the last 1 hour.

Resolve
Initialize NBT protocol

To initialize the NBT protocol, disable and then re-enable the network adapter:

You must be logged on as an administrator or belong to the Administrators group to complete these steps.

  1. Click Start, click Control Panel, double-click Device Manager, expand Network Adapters, right-click the adapter you want to initialize, click Disable, and then click Yes.
  2. Right-click the adapter that you just disabled, and then click Enable.

Verify

Attempt to access a remote shared network folder. If you can access the shared network folder, then the Windows Internet Name Service (WINS) server and the NBT protocol are functioning properly.

Related Management Information

NBT Connectivity

Networking

Related:

Event ID 4320 — NBT Naming

Event ID 4320 — NBT Naming

Updated: January 7, 2009

Applies To: Windows Server 2008 R2

NBT (NetBIOS (network basic input/output system)) over TCP/IP (Transmission Control Protocol/Internet Protocol) naming provides mapping between NetBIOS names and IP addresses.

Event Details

Product: Windows Operating System
ID: 4320
Source: netbt
Version: 6.1
Symbolic Name: EVENT_NBT_NAME_RELEASE
Message: Another computer has sent a name release message to this computer, probably because a duplicate name has been detected on the TCP network. The IP address of the node that sent the message is in the data. Use nbtstat -n in a command window to see which name is in the Conflict state.

Resolve
Rename the local computer

Computers must have unique names on the network.

To rename the local computer:

You must be logged on as an administrator or belong to the Administrators group to complete these steps.

  1. Click Start, click Control Panel, click System, and then click Change Settings.
  2. Click Change Computer Name, type the new computer name, and then click OK.

 

Verify

To verify that the name can be resolved, ping a remote host by name:

  1. Click Start, click All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator. 
  2. Type ping [hostname].
  3. If the ping succeeds, then the name was successfully resolved.

Note:  Ping will fail if the remote server does not have File and Print sharing enabled and a File and Printer Sharing exception in Windows Firewall enabled. On Windows Server 2008, installing the File Server or Domain Controller roles will do this, as will sharing a printer.

Related Management Information

NBT Naming

Networking

Related:

Event ID 4319 — NBT Naming

Event ID 4319 — NBT Naming

Updated: April 17, 2008

Applies To: Windows Server 2008

NBT (NetBIOS (network basic input/output system)) over TCP/IP (Transmission Control Protocol/Internet Protocol) naming provides mapping between NetBIOS names and IP addresses.

Event Details

Product: Windows Operating System
ID: 4319
Source: netbt
Version: 6.0
Symbolic Name: EVENT_NBT_DUPLICATE_NAME
Message: A duplicate name has been detected on the TCP network. The IP address of the computer that sent the message is in the data. Use nbtstat -n in a command window to see which name is in the Conflict state.

Resolve
Rename the local computer

Computers must have unique names on the network.

To rename the local computer:

You must be logged on as an administrator or belong to the Administrators group to complete these steps.

  1. Click Start, click Control Panel, click System, and then click Change Settings.
  2. Click Change Computer Name, type the new computer name, and then click OK.

 

Verify

To verify that the name can be resolved, ping a remote host by name:

  1. Click Start, click All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator. 
  2. Type ping [hostname].
  3. If the ping succeeds, then the name was successfully resolved.

Note:  Ping will fail if the remote server does not have File and Print sharing enabled and a File and Printer Sharing exception in Windows Firewall enabled. On Windows Server 2008, installing the File Server or Domain Controller roles will do this, as will sharing a printer.

Related Management Information

NBT Naming

Networking

Related:

Event ID 4315 — NBT Connectivity

Event ID 4315 — NBT Connectivity

Updated: April 17, 2008

Applies To: Windows Server 2008

NBT (NetBIOS (network basic input/output system)) over TCP/IP (Transmission Control Protocol/Internet Protocol) connectivity facilitates file and printer sharing.

Event Details

Product: Windows Operating System
ID: 4315
Source: netbt
Version: 6.0
Symbolic Name: EVENT_NBT_READ_EXPORT
Message: Unable to read the driver’s exported linkage configuration information.

Resolve
Initialize NBT protocol

To initialize the NBT protocol, disable and then re-enable the network adapter:

You must be logged on as an administrator or belong to the Administrators group to complete these steps.

  1. Click Start, click Control Panel, double-click Device Manager, expand Network Adapters, right-click the adapter you want to initialize, click Disable, and then click Yes.
  2. Right-click the adapter that you just disabled, and then click Enable.

Verify

Attempt to access a remote shared network folder. If you can access the shared network folder, then the Windows Internet Name Service (WINS) server and the NBT protocol are functioning properly.

Related Management Information

NBT Connectivity

Networking

Related:

Event ID 4314 — NBT Connectivity

Event ID 4314 — NBT Connectivity

Updated: January 7, 2009

Applies To: Windows Server 2008 R2

NBT (NetBIOS (network basic input/output system)) over TCP/IP (Transmission Control Protocol/Internet Protocol) connectivity facilitates file and printer sharing.

Event Details

Product: Windows Operating System
ID: 4314
Source: netbt
Version: 6.1
Symbolic Name: EVENT_NBT_READ_BIND
Message: Unable to read the driver’s bindings to the transport from the registry.

Resolve
Initialize NBT protocol

To initialize the NBT protocol, disable and then re-enable the network adapter:

You must be logged on as an administrator or belong to the Administrators group to complete these steps.

  1. Click Start, click Control Panel, double-click Device Manager, expand Network Adapters, right-click the adapter you want to initialize, click Disable, and then click Yes.
  2. Right-click the adapter that you just disabled, and then click Enable.

Verify

Attempt to access a remote shared network folder. If you can access the shared network folder, then the Windows Internet Name Service (WINS) server and the NBT protocol are functioning properly.

Related Management Information

NBT Connectivity

Networking

Related:

Event ID 4310 — NBT Connectivity

Event ID 4310 — NBT Connectivity

Updated: April 17, 2008

Applies To: Windows Server 2008

NBT (NetBIOS (network basic input/output system)) over TCP/IP (Transmission Control Protocol/Internet Protocol) connectivity facilitates file and printer sharing.

Event Details

Product: Windows Operating System
ID: 4310
Source: netbt
Version: 6.0
Symbolic Name: EVENT_NBT_TIMERS
Message: Initialization failed because the timers could not be started.

Resolve
Initialize NBT protocol

To initialize the NBT protocol, disable and then re-enable the network adapter:

You must be logged on as an administrator or belong to the Administrators group to complete these steps.

  1. Click Start, click Control Panel, double-click Device Manager, expand Network Adapters, right-click the adapter you want to initialize, click Disable, and then click Yes.
  2. Right-click the adapter that you just disabled, and then click Enable.

Verify

Attempt to access a remote shared network folder. If you can access the shared network folder, then the Windows Internet Name Service (WINS) server and the NBT protocol are functioning properly.

Related Management Information

NBT Connectivity

Networking

Related:

Event ID 4309 — NBT Connectivity

Event ID 4309 — NBT Connectivity

Updated: April 17, 2008

Applies To: Windows Server 2008

NBT (NetBIOS (network basic input/output system)) over TCP/IP (Transmission Control Protocol/Internet Protocol) connectivity facilitates file and printer sharing.

Event Details

Product: Windows Operating System
ID: 4309
Source: netbt
Version: 6.0
Symbolic Name: EVENT_NBT_NON_OS_INIT
Message: Data structure initialization failed.

Resolve
Initialize NBT protocol

To initialize the NBT protocol, disable and then re-enable the network adapter:

You must be logged on as an administrator or belong to the Administrators group to complete these steps.

  1. Click Start, click Control Panel, double-click Device Manager, expand Network Adapters, right-click the adapter you want to initialize, click Disable, and then click Yes.
  2. Right-click the adapter that you just disabled, and then click Enable.

Verify

Attempt to access a remote shared network folder. If you can access the shared network folder, then the Windows Internet Name Service (WINS) server and the NBT protocol are functioning properly.

Related Management Information

NBT Connectivity

Networking

Related:

Event ID 4308 — NBT Connectivity

Event ID 4308 — NBT Connectivity

Updated: January 7, 2009

Applies To: Windows Server 2008 R2

NBT (NetBIOS (network basic input/output system)) over TCP/IP (Transmission Control Protocol/Internet Protocol) connectivity facilitates file and printer sharing.

Event Details

Product: Windows Operating System
ID: 4308
Source: netbt
Version: 6.1
Symbolic Name: EVENT_NBT_CREATE_CONNECTION
Message: Initialization failed because the transport refused to open initial connections.

Resolve
Initialize NBT protocol

To initialize the NBT protocol, disable and then re-enable the network adapter:

You must be logged on as an administrator or belong to the Administrators group to complete these steps.

  1. Click Start, click Control Panel, double-click Device Manager, expand Network Adapters, right-click the adapter you want to initialize, click Disable, and then click Yes.
  2. Right-click the adapter that you just disabled, and then click Enable.

Verify

Attempt to access a remote shared network folder. If you can access the shared network folder, then the Windows Internet Name Service (WINS) server and the NBT protocol are functioning properly.

Related Management Information

NBT Connectivity

Networking

Related: