We have ENTA and was looking for a way to detect SMBv1 (and possibly SMBv2) through the Network Flow logs, I didn’t found any key-value pairs to distinguish between different versions of the SMB protocol but could also be that all our captured traffic is already SMBv3. Anyone have experience and care to share their insights on this?