Cisco Cisco Firepower Management Center 4000

To enable extraction of recipient email addresses, select 

.

To enable extraction of sender email addresses to associate with intrusion events, select 

.

To enable extraction of email headers to associate with intrusion events and for writing rules that 
inspect email headers, select 

.

Note that header information is displayed in the intrusion event packet view. Note also that you can 
also write intrusion rules that use the 

content

 keyword with email header data as a pattern. See 

 for more 

information.

Optionally, you can specify a 

 of 0 to 20480 bytes of the email header to extract. A 

value of 0 disables 

.

Optionally, click 

 at the top of the page to display rules associated 

with individual options.

Click 

 to return to the SMTP Configuration page.

Save your policy, continue editing, discard your changes, revert to the default configuration settings in 
the base policy, or exit while leaving your changes in the system cache. See the 

 table for more information.

Protection

You can enable SMTP preprocessor rule 124:9 to generate an event when the enabled preprocessor is 
using the maximum amount of memory allowed by the system for decoding the following types of 
encoded data:

Base64

7-bit/8-bit/binary

Quoted-printable

Unix-to-Unix

When the maximum decoding memory is exceeded, the preprocessor stops decoding these types of 
encoded data until memory becomes available. This preprocessor rule is not associated with a single, 
specific configuration option. See 

 for information on enabling rules.

Protection

The SSH preprocessor detects the Challenge-Response Buffer Overflow exploit, the CRC-32 exploit, the 
SecureCRT SSH Client Buffer Overflow exploit, protocol mismatches, and incorrect SSH message 
direction. The preprocessor also detects any version string other than version 1 or 2.

Both Challenge-Response Buffer Overflow and CRC-32 attacks occur after the key exchange and are, 
therefore, encrypted. Both attacks send an uncharacteristically large payload of more than 20 KBytes to 
the server immediately after the authentication challenge. CRC-32 attacks apply only to SSH Version 1;