SMTP Lua Parser Options

Caution: RSA strongly suggests that you do not subscribe to the options file. Subsequent downloads of this file will overwrite all changes that you have made to the file.

Note the following:

• If you deploy the options file, it can be found in the same directory as parsers: /etc/netwitness/ng/parsers/.
• The parser is not dependent upon the options file. The parser will load and run even in the absence of the options file. The options file is only required if you need to change the default settings.
• If you do not have an options file (or if your options file is invalid), the parser uses the default settings.

Note: The parser will never use both the defaults and customized options. If the options file exists and its contents can be loaded, then the defaults will not be used at all.

The SMTP_lua_options file contains the following options for controlling the parser:

• registerEmailSrcDst
• registerAddressHosts
• errorCodeOnly

To change an option from false to true, edit the line inside the corresponding function, from

return false

to

return true

And similarly to go from true to false.

registerEmailSrcDst

Default value: false

Determines whether or not to register email address meta using the index keys email.src and email.dst.

• If set to false, all email address meta is registered with the index key email.

• If set to true:

  • Originating email addresses are registered with the index key email.src
  • Recipient email addresses are registered with the index key email.dst
  • Targets of EXPN and VRFY are registered with the index key email.dst

Note: Modifying this option requires a service restart to take effect; a simple parser reload is insufficient.

registerAddressHosts

Default value: false

Determines whether or not to register the host portion of email addresses as meta. The key used to register is alias.host, alias.ip, or alias.ipv6 as appropriate.

errorCodeOnly

Default value: true

Determines whether or not to register error codes only, or the entire error messages.

• If set to true, only the error code (such as "450", "550", and so on) is registered.
• If set to false, the entire error message is registered (e.g., "550 unknown user"). In the case of a 421 server greeting, the server name is removed from the error text and be registered as alias.[host|ip|ipv6] instead.