HIDS 3398
| Rule 1 | |
|---|---|
| Status | Active |
| Alert Message | Postfix event |
Contents |
Description
Postfix is indicating that an invalid (aka "illegal") email address is being used in the From line.
What you should do
This could indicate a poorly configured spam attempt, or a misconfigured application. Generally it manifests if the From line field is incomplete, like "user@" or "@domain" instead of the valid "user@domain". Investigate the details of the log on the email address, and the sending source to establish if this is an internal misconfigured application. If it is not, then this is a spam attempt and can be ignored.
Troubleshooting
False Positives
There are no false positives with this rule.
Tuning Guidance
There is no guidance for tuning this rule, this is a generic error and the rule should not be disabled.
Additional Information
Support
If you are unsure about how to respond to this alert, please contact Atomicorp support. We're here to help you!
Similar Rules
None.
Knowledge Base Articles
None.
Outside References
None.
