SERVICE.SMTP Match/Trigger

[g.schaarup]

If I setup a customer signature by using SERVICE.SMTP and only change the:

RegexString to f.ex.:

tst.tester@testing.com

and StateName to the value:

Mailheader

I dont see any events (the signature is enabled, and a test with the STRING.TCP works fine).

How do a configure the SERVICE.SMTP to trigger when it sees a mailheader containing tst.tester@testing.com ??

Thanks

Sensor:

OS Version 2.4.18-5smpbigphysx

Platform: IDS-4235

IDS-sig-4.1-4-S155

IDSMC:

CiscoWorks Common Services with SP2 2.2

IDS Management Center 2.0

Security Monitor 2.0

[mcerha]

There is a known bug in the SERVICE.SMTP engine with the handling of regexes. Unfortunately, I cannot find the specific DDTS Id for the issue. Under 4.x, it is currently not possible to add new signatures to this engine. You will have to use STRING.TCP engine as you noted. This issue has been resolved in the 5.0 version of the sensor.

[g.schaarup]

Could the known bug be CSCee24687 ?

"Cannot store more signatures in the SMTP engine. Custom Sig fails."

Will this bug be solved in future release for version 4.0 ?

[mcerha]

That looks like the bug indeed. I don't have any idea if this bug is scheduled to be fixed in 4.x though as no firm commitment on the next 4.x service pack has been made to my knowledge.