Binding IPS log row with e-mail message

[danielc]

Hallo,

I observe logs from IPS in SmartLog relative to SMTP service and I can't find any information about smtp message header (sender or subject like in DLP or Threat emulation). It is important because I have to find e-mail message, on mail server, corresponding to current log row. So please help how can I bind current log row with e-mail message on mail server. Is there any way ?

Regards
Daniel

[varera]

IPS does not "intercept" messages but only inspects protocol abuses. For that reason you will not be able to achieve your goal.

Alternatively, you can add packet capture to IPS logs for further investigation


Sent from my iPhone using Tapatalk

[danielc]

Hi,

thank you for your advice. It was very helpfull. The goal is achived.

[varera]

Hi,

thank you for your advice. It was very helpfull. The goal is achived.

Cool :-)