rules: Add smtp_envelope and smtp_header keywords
Add smtp_envelope and smtp_header keywords.
The envelope is composed of communication before the DATA segment ( example at http://en.wikipedia.org/wiki/SMTP#SMTP_transport_example) and the header is the part of the email content before there is the mail body (which should be anything between DATA and the first occurence of CR LF CR LF).
The idea is to allow rules searching for email addresses, mail user-agents, etc.. while not matching on the same pattern(s) being discussed in an email body.
Updated by Christophe Vandeplas almost 10 years ago
Email subject and attachment names are also very interesting keywordsDo consider that data need to be normalized as the data:
- can be split in multiple lines
- can be encoded following RFC2047 (
From: =?US-ASCII?Q?Keith_Moore?= <email@example.com> , Subject: =?ISO-8859-1?B?SWYgeW91IGNhbiByZWFkIHRoaXMgeW8=?=)