[Oisf-users] sid 220006

[erik clark]

 app-layer-event:smtp.no_server_welcome_message;
flowint:smtp.anomaly.count,+,1

Can someone explain to me how this is determined? My payload_printable is:

220 $hostname ESMTP Postfix

where $hostname is actually the hostname. Thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20180702/426c24cd/attachment.html>