Patt 5 : SMTP Session Messages

Patt 5 : SMTP Session Messages

Base Rule

General Information

Information

Rejected Message

Sub Rule

Suspicious E-mail Activity

Suspicious

Accepted Message

Sub Rule

Message Accepted

Other Audit Success

Timeout Message

Sub Rule

Connection Timeout

Warning

SMTP Session Deleted

Sub Rule

Session Ended

Information

Looking For Session Relay

Sub Rule

Session Information

Information

Lookup SMTP Session

Sub Rule

Session Information

Information

Put SMTP Session

Sub Rule

Session Information

Information

Reloaded Session Relay

Sub Rule

Session Started

Other Audit Success

Save Session Relay

Sub Rule

Session Information

Information

N/A

<processid>

Number

N/A

<subject>

Text/String

N/A

<sname>

String

N/A

<sip>

Number

N/A

<sport>

Text/String/Number

N/A

<tag1>

Text/String

N/A

<session>.

String

N/A

<sender>

String

N/A

<recipient>

String

N/A

<protname>

String

N/A

<vendorinfo>

String

N/A

<dip>

Number

N/A

<dport>

Text/String/Number