Cisco Cisco Firepower Management Center 4000

When quoted-printable decoding is enabled, you can enable rule 124:11 to generate an event when 
decoding fails; decoding could fail, for example, because of incorrect encoding or corrupted data. 
See 

 for more information.

When

 is disabled, specifies the maximum number of bytes to extract and decode from 

each Unix-to-Unix encoded (uuencoded) email attachment. You can specify from 1 to 65535 bytes, 
or specify 0 to decode all uuencoded data in the packet. Specify -1 to ignore uuencoded data. The 
preprocessor will not decode data when 

 is selected.

When Unix-to-Unix decoding is enabled, you can enable rule 124:13 to generate an event when 
decoding fails; decoding could fail, for example, because of incorrect encoding or corrupted data. 
See 

 for more information.

Enables extraction of MIME attachment file names from the MIME Content-Disposition header and 
associates the file names with all intrusion events generated for the session. Multiple file names are 
supported.

When this option is enabled, you can view file names associated with events in the Email 
Attachment column of the intrusion events table view. See 

 for more information.

Enables extraction of recipient email addresses from the SMTP RCPT TO command and associates 
the recipient addresses with all intrusion events generated for the session. Multiple recipients are 
supported. 

When this option is enabled, you can view recipients associated with events in the Email Recipient 
column of the intrusion events table view. See 

 for more 

information.

Enables extraction of sender email addresses from the SMTP MAIL FROM command and associates 
the sender addresses with all intrusion events generated for the session. Multiple sender addresses 
are supported. 

When this option is enabled, you can view senders associated with events in the Email Sender 
column of the intrusion events table view. See 

 for more 

information.

Enables extraction of email headers. The number of bytes to extract is determined by the value 
specified for 

.

You can use the 

content

 keyword to write intrusion rules that use email header data as a pattern. 

You can also view the extracted email header in the intrusion event packet view. See 

 and 

 for more information. 

Specifies the number of bytes of the email header to extract when 

 is enabled. You can 

specify 0 to 20480 bytes. A value of 0 disables 

.