IPS \ Application Signature

[along]

Hi all

I need to write ips / application signature to recognize sender and recipient in SMTP

for example:

If smtp sender A send mail to recipent B - Allow.

If smtp sender A send mail to recipent C - Block

I will be happy if anyone know how to do it.

Alon

[rmonvon]

Hi...You can try to create a custom app to match the pattern using the context of 'smtp-req-argument'.  More info can be found here:

Thanks,

[mikand]

By the way does the same options (well what you can trigger on such as "smtp-req-argument") exist in both custom app aswell as custom ips or are there differences?

Im thinking of when one should do a custom app instead off a custom ips signature?