topic SERVICE.SMTP Match/Trigger in Network Security

SERVICE.SMTP Match/Trigger

g.schaarup — Sun, 10 Mar 2019 09:23:09 GMT

If I setup a customer signature by using SERVICE.SMTP and only change the:

RegexString to f.ex.:

tst.tester@testing.com

and StateName to the value:

Mailheader

I dont see any events (the signature is enabled, and a test with the STRING.TCP works fine).

How do a configure the SERVICE.SMTP to trigger when it sees a mailheader containing tst.tester@testing.com ??

Thanks

Sensor:

OS Version 2.4.18-5smpbigphysx

Platform: IDS-4235

IDS-sig-4.1-4-S155

IDSMC:

CiscoWorks Common Services with SP2 2.2

IDS Management Center 2.0

Security Monitor 2.0

Re: SERVICE.SMTP Match/Trigger

mcerha — Tue, 12 Apr 2005 08:10:27 GMT

There is a known bug in the SERVICE.SMTP engine with the handling of regexes. Unfortunately, I cannot find the specific DDTS Id for the issue. Under 4.x, it is currently not possible to add new signatures to this engine. You will have to use STRING.TCP engine as you noted. This issue has been resolved in the 5.0 version of the sensor.

Re: SERVICE.SMTP Match/Trigger

g.schaarup — Tue, 12 Apr 2005 12:00:07 GMT

Could the known bug be CSCee24687 ?

"Cannot store more signatures in the SMTP engine. Custom Sig fails."

Will this bug be solved in future release for version 4.0 ?

Re: SERVICE.SMTP Match/Trigger

mcerha — Tue, 12 Apr 2005 12:21:27 GMT

That looks like the bug indeed. I don't have any idea if this bug is scheduled to be fixed in 4.x though as no firm commitment on the next 4.x service pack has been made to my knowledge.