[out] LsarSidArray *sids);

	typedef [v1_enum] enum {
		SE_GROUP_MANDATORY          = 0x00000001,
		SE_GROUP_ENABLED_BY_DEFAULT = 0x00000002,
		SE_GROUP_ENABLED            = 0x00000004,
		SE_GROUP_OWNER              = 0x00000008,
		SE_GROUP_USE_FOR_DENY_ONLY  = 0x00000010,
		SE_GROUP_RESOURCE           = 0x20000000,
		SE_GROUP_LOGON_ID           = 0xC0000000
	} SamrGroupAttrs;

	typedef struct {
		uint32_t rid;

			[out] LsarSidArray *sids);

	typedef [v1_enum] enum {
		SE_GROUP_MANDATORY          = 0x00000001,
		SE_GROUP_ENABLED_BY_DEFAULT = 0x00000002,
		SE_GROUP_ENABLED            = 0x00000004,
		SE_GROUP_OWNER              = 0x00000008,
		SE_GROUP_USE_FOR_DENY_ONLY  = 0x00000010,
		SE_GROUP_RESOURCE           = 0x20000000,
		SE_GROUP_LOGON_ID           = 0xC0000000
	} SamrGroupAttrs;

	typedef struct {
		uint32_t rid;

            0x00000400, 0x01010004, 0x00010000, 0x00010400, 0x01000004, 0x00000400, 0x00000004, 0x01000404, 0x00010404, 0x01010404,
            0x00010004, 0x01010000, 0x01000404, 0x01000004, 0x00000404, 0x00010404, 0x01010400, 0x00000404, 0x01000400, 0x01000400,
            0x00000000, 0x00010004, 0x00010400, 0x00000000, 0x01010004 };

            verify(mockFileNotifyInfo, times(1)).getFileName();
        }

        @ParameterizedTest
        @ValueSource(ints = { 0x00000001, 0x00000002, 0x00000003, 0x00000004, 0x00000005, 0x00000006, 0x00000007, 0x00000008, 0x00000009 })
        @DisplayName("Test getAction with various action values")
        void testGetActionWithVariousValues(int actionValue) {

    /**
     * File has been modified
     */
    int FILE_ACTION_MODIFIED = 0x00000003;

    /**
     * File has been renamed (old name)
     */
    int FILE_ACTION_RENAMED_OLD_NAME = 0x00000004;

    /**
     * File has been renamed (new name)
     */
    int FILE_ACTION_RENAMED_NEW_NAME = 0x00000005;

    /**
     * File stream has been added
     */

        assertEquals(0x00000001, NtlmFlags.NTLMSSP_NEGOTIATE_UNICODE, "NTLMSSP_NEGOTIATE_UNICODE should be 0x00000001");
    }

    @Test
    void testNtlmNegotiateOem() {
        assertEquals(0x00000002, NtlmFlags.NTLMSSP_NEGOTIATE_OEM, "NTLMSSP_NEGOTIATE_OEM should be 0x00000002");
    }

    @Test
    void testNtlmRequestTarget() {

     * SMB2 File Action constants
     */
    private static final int FILE_ACTION_ADDED = 0x00000001;
    private static final int FILE_ACTION_REMOVED = 0x00000002;
    private static final int FILE_ACTION_MODIFIED = 0x00000003;
    private static final int FILE_ACTION_RENAMED_OLD_NAME = 0x00000004;
    private static final int FILE_ACTION_RENAMED_NEW_NAME = 0x00000005;

    /**
     * SMB2 File Notify Change constants
     */

        assertTrue(result.contains("maxRawSize=8192"));
        assertTrue(result.contains("sessionKey=0x00ABCDEF"));
        // CAP_UNICODE is 0x0004, when formatted as 8 hex digits = 0x00000004
        assertTrue(result.contains("capabilities=0x00000004"));
        assertTrue(result.contains("serverTime=" + new Date(serverData.serverTime)));
        assertTrue(result.contains("serverTimeZone=300"));

        // Test with different access masks
        int[] accessMasks = { 0x00000001, // SAM_SERVER_CONNECT
                0x00000002, // SAM_SERVER_SHUTDOWN
                0x00000004, // SAM_SERVER_INITIALIZE
                0x00000008, // SAM_SERVER_CREATE_DOMAIN
                0x00000010, // SAM_SERVER_ENUMERATE_DOMAINS
                0x00000020, // SAM_SERVER_LOOKUP_DOMAIN
                0x000F003F, // SAM_SERVER_ALL_ACCESS

    assertThat(frameLog(false, 0, 0, TYPE_SETTINGS, FLAG_ACK))
      .isEqualTo(">> 0x00000000     0 SETTINGS      ACK")
    assertThat(frameLog(true, 0, 0, TYPE_SETTINGS, FLAG_ACK))
      .isEqualTo("<< 0x00000000     0 SETTINGS      ACK")
    assertThat(frameLog(true, 3, 22, TYPE_HEADERS, FLAG_END_HEADERS))
      .isEqualTo("<< 0x00000003    22 HEADERS       END_HEADERS")