Cisco Cisco Firepower Management Center 4000

RCPT TO and MAIL FROM are SMTP commands. The preprocessor configuration uses 
command names of RCPT and MAIL, respectively. Within the code, the preprocessor maps 
RCPT and MAIL to the correct command name.

If needed, click 

 next to 

 to add commands where you want to specify an 

alternate maximum command line length, then specify the line length and the command or commands, 
separated by spaces, where you want that length to be enforced. 

Specify any commands that you want to treat as invalid and detect in the 

 field. Separate 

commands with spaces.

Specify any commands that you want to treat as valid in the 

 field. Separate commands 

with spaces.

Even if the 

 list is empty, the preprocessor treats the following commands as valid: 

ATRN, AUTH, BDAT, DATA, DEBUG, EHLO, EMAL, ESAM, ESND, ESOM, ETRN, EVFY, 
EXPN, HELO, HELP, IDENT, MAIL, NOOP, QUIT, RCPT, RSET, SAML, SOML, SEND, 
ONEX, QUEU, STARTTLS, TICK, TIME, TURN, TURNME, VERB, VRFY, X-EXPS, 
X-LINK2STATE, XADR, XAUTH, XCIR, XEXCH50, XGEN, XLICENSE, XQUE, XSTA, 
XTRN, or XUSR. 

Specify any commands that you want to initiate sending data in the same way the SMTP DATA command 
sends data per RFC 5321 in the 

 field. Separate commands with spaces.

Specify any commands that initiate sending data in a way that is similar to how the BDAT command 
sends data per RFC 3030 in the 

 field. Separate commands with spaces.

Specify any commands that initiate an authentication exchange between client and server in the 

 field. Separate commands with spaces.

To detect packets that are part of X-Link2State Microsoft Exchange buffer data overflow attacks, select 

.

To specify the maximum bytes of data to extract and decode for different types of email attachment, 
specify a value for any of the following attachment types:

 (includes various multipart content types such as plain text, jpeg 

images, mp3 files, and so on)

You can specify from 1 to 65535 bytes, or specify 0 to extract and, when necessary, decode all data in 
the packet for that type. Specify -1 to ignore data for an attachment type.

You can use the 

file_data

 rule keyword in intrusion rules to inspect extracted data. See 

 for more information.

You must also select the SMTP 

 option to extract and decode cross-packet data or data 

crossing multiple TCP segments.

Configure options for associating contextual information with intrusion events triggered by SMTP 
traffic:

To enable extraction of MIME attachment file names to associate with intrusion events, select 

.