Suricata

We should probably inspect the decoded attachments with it, like Snort does: "When the traffic is SMTP the file_data points to the decoded attachments when decoding is enabled for those preprocessors, otherwise to the entire data body." http://blog.snort.org/2011/08/snort-291-where-does-filedata-point.html

- headers
- raw_headers
- envelope.from
- envelope.to

to start with. Won't be hard to support these.

Let's start with file_data first of course.

This has been TBD'd?!?! Wheres Peter? I need a shoulder to cry on. We need this.

This type of functionality would be VERY useful for creating alerting based on spammed out/speared attacks coming in via SMTP. Without this, currently you are unable to even create IDS alerting for .exe files, encrypted zip files, etc that are coming to your users through the mail flow.