Detects and identifies the NTLM version contained in the NTLM response. If this
field is set to 1, the protocol has been detected; if set to 0, the protocol has not been
detected. Does not cover the entire payload.
Context Capture
This context covers the sections called out in blue.