|
|
|
|
@ -1159,6 +1159,25 @@ app-layer:
|
|
|
|
|
enabled: yes
|
|
|
|
|
smtp:
|
|
|
|
|
enabled: yes
|
|
|
|
|
# Configure SMTP-MIME Decoder
|
|
|
|
|
mime:
|
|
|
|
|
# Decode MIME messages from SMTP transactions
|
|
|
|
|
# (may be resource intensive)
|
|
|
|
|
# This field supercedes all others because it turns the entire
|
|
|
|
|
# process on or off
|
|
|
|
|
decode-mime: yes
|
|
|
|
|
|
|
|
|
|
# Decode MIME entity bodies (ie. base64, quoted-printable, etc.)
|
|
|
|
|
decode-base64: yes
|
|
|
|
|
decode-quoted-printable: yes
|
|
|
|
|
|
|
|
|
|
# Maximum bytes per header data value stored in the data structure
|
|
|
|
|
# (default is 2000)
|
|
|
|
|
header-value-depth: 2000
|
|
|
|
|
|
|
|
|
|
# Extract URLs and save in state data structure
|
|
|
|
|
extract-urls: yes
|
|
|
|
|
|
|
|
|
|
imap:
|
|
|
|
|
enabled: detection-only
|
|
|
|
|
msn:
|
|
|
|
|
@ -1295,23 +1314,6 @@ app-layer:
|
|
|
|
|
# double-decode-path: no
|
|
|
|
|
# double-decode-query: no
|
|
|
|
|
|
|
|
|
|
# Configure SMTP-MIME Decoder enhancements
|
|
|
|
|
smtp-mime:
|
|
|
|
|
|
|
|
|
|
# Decode MIME messages from SMTP transactions (may be resource intensive)
|
|
|
|
|
# This field supercedes all others because it turns the entire process on or off
|
|
|
|
|
decode-mime: yes
|
|
|
|
|
|
|
|
|
|
# Decode MIME entity bodies (ie. base64, quoted-printable, etc.)
|
|
|
|
|
decode-base64: yes
|
|
|
|
|
decode-quoted-printable: yes
|
|
|
|
|
|
|
|
|
|
# Maximum bytes per header data value stored in the data structure (default is 2000)
|
|
|
|
|
header-value-depth: 2000
|
|
|
|
|
|
|
|
|
|
# Extract URLs and save in state data structure
|
|
|
|
|
extract-urls: yes
|
|
|
|
|
|
|
|
|
|
# Profiling settings. Only effective if Suricata has been built with the
|
|
|
|
|
# the --enable-profiling configure flag.
|
|
|
|
|
#
|
|
|
|
|
|