A single line from the client to the server. Multi-line commands will have a frame per
line. Lines part of the SMTP DATA transfer are excluded.
-.. container:: example fule
+.. container:: example-rule
alert smtp any any -> any any ( \
:example-rule-options:`frame:smtp.command_line; content:"MAIL|20|FROM:"; startswith;` \
A single line from the server to the client. Multi-line commands will have a frame per line.
-.. container:: example fule
+.. container:: example-rule
alert smtp any any -> any any ( \
:example-rule-options:`frame:smtp.response_line; content:"354 go ahead"; startswith;` \
A streaming buffer containing the DATA bytes sent from client to server.
-.. container:: example fule
+.. container:: example-rule
alert smtp any any -> any any ( \
:example-rule-options:`frame:smtp.data; content:"Reply-To:"; startswith; content:"Subject"; distance:0;` \
Streaming buffer of the entire TCP data for the SMTP session.
-.. container:: example fule
+.. container:: example-rule
alert smtp any any -> any any (flow:to_client; \
:example-rule-options:`frame:smtp.stream; content:"250 ok|0d 0a|354 go ahead";` \