Protocol-specific properties

In addition to providing properties that are common across most protocols, ADM also provides protocol-specific properties that can be used with ADM rules. All protocol-specific properties are also available in the Expression Component page when adding an ADM rule.

Examples of protocol-specific properties

These properties apply to these tables:

*   Detection only
**  No decryption, captures X.509 certificates and encrypted data
*** Via RFC822 module

Table 1: File transfer protocol modules
FTP HTTP SMB* SSL**
Display Name

File Name

Host Name

URL

Display Name

File Name

Host Name

Referer

URL

All HTTP headers

Display Name

File Name

Host Name

Display Name

File Name

Host Name

Table 2: Email protocol modules
DeltaSync MAPI NNTP POP3 SMTP

Bcc***

Cc***

Display Name

From***

Host Name

Subject***

To***

Bcc

Cc

Display Name

From

Host Name

Subject

To

User Name

Bcc***

Cc***

Display Name

From***

Host Name

Subject***

To***

Bcc***

Cc***

Display Name

From***

Host Name

Subject***

To***

User Name

Bcc***

Cc***

Display Name

From***

Host Name

To***

Subject***

Table 3: Webmail protocol modules
AOL Gmail Hotmail Yahoo

Attachment Name

Bcc***

Cc***

Display Name

File Name

Host Name

From***

Subject***

To***

Attachment Name

Bcc***

Cc***

Display Name

File Name

Host Name

From***

Subject***

To***

Attachment Name

Bcc***

Cc***

Display Name

File Name

Host Name

From***

Subject***

To***

Attachment Name

Bcc***

Cc***

Display Name

File Name

Host Name

From***

Subject***

To***