Suricata

Suricata has an app-layer parser / protocol support for SMTP builtin since long time ago, but no keywords are available for use in rules.

This feature request wants to add SMTP keyword support to Suricata, so that these keywords can be used in rules.

To focus development, this ticket also tries to collect some helpful use cases for such SMTP keywords:

• MAIL FROM: <address> and RCPT TO: <address> compatible to use in datasets, e.g. e-mail blacklist
• HELO / EHLO: <server> -> dataset blacklist
• AUTH to detect multiple login attempts
• Return-Codes
• Other headers (Subject, Content-Type) in the DATA part, ideally with custom header support

Feel free to add further use cases.

Thanks!