- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
06-16-2021 09:28 AM
Hello,
Is there any difference between "email-headers" and "smtp-email-headers" context in the customer application definition?
I didn't find description of the "smtp-email-headers" context in "Custom Application IDs and Signatures" guide.
Maybe "email-headers" can be used for any email protocol and "smtp-email-headers" only for SMTP?
Thanks
01-13-2022 12:56 AM
The last I saw there were options for HTTP headers but I didn't see for email headers but you can double check it. See the link below and search for ''Pattern match''' with smtp:
Create Custom Application Signature (paloaltonetworks.com)
01-13-2022 04:40 AM
Hello Nikolay.
I wrote that I didn't find description of the "smtp-email-headers" context in Custom Application IDs and Signatures guide. But this context is present in the list of available context options for Customer App in the real device software (for example PA-820, at least for s/w 9.1.x and later). See attached screenshot.
The "email-headers" context description can be found using Search Box under Table of Contents in the document mentioned in your answer. Link to search result is
https://docs.paloaltonetworks.com/pan-os/u-v/custom-app-id-and-threat-signatures/custom-application-...
As I didn't find "smtp-email-headers" description I hoped someone explains the difference between these 2 contexts.
Thanks for your reply
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!