email.subject matches on MIME EMAIL SUBJECT This keyword maps to the EVE field email.subject It is a sticky buffer Supports prefiltering Ticket: #7595