Documentation #6495
Updated by Juliana Fajardini Reichow about 2 months ago
Our guide has a section for SMTP for configuration (cf https://docs.suricata.io/en/latest/configuration/suricata-yaml.html#smtp), but nothing to add more details on EVE output or format. ---- This is what we have in our yaml: - smtp: smtp:¬ #extended: yes # enable this for extended logging information information¬ # this includes: bcc, message-id, subject, x_mailer, user-agent user-agent¬ # custom fields logging from the list: list:¬ # reply-to, bcc, message-id, subject, x-mailer, user-agent, received, received,¬ # x-originating-ip, in-reply-to, references, importance, priority, priority,¬ # sensitivity, organization, content-md5, date date¬ #custom: [received, x-mailer, x-originating-ip, relays, reply-to, bcc] bcc]¬ # output md5 of fields: body, subject subject¬ # for the body you need to set app-layer.protocols.smtp.mime.body-md5 app-layer.protocols.smtp.mime.body-md5¬ # to yes yes¬ #md5: [body, subject] subject]¬