SMTP rule needed

[Paul.Simons () ihsenergy com]

How can I write a rule to flag when someone inside sends (or receives) and
email (SMTP) with 'mycompany.com' in the message body?
I have tried but I can't seem to get the syntax right.
Paul


_______________________________________________________________

Sponsored by:
Looking for hip toys and fun scwag.  There is no better place
then the good friends at ThinkGeek. http://www.ThinkGeek.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users