diff --git a/scripts/policy/protocols/smtp/software.zeek b/scripts/policy/protocols/smtp/software.zeek index 69cfdf4c57..342beedae0 100644 --- a/scripts/policy/protocols/smtp/software.zeek +++ b/scripts/policy/protocols/smtp/software.zeek @@ -48,7 +48,7 @@ export { event mime_one_header(c: connection, h: mime_header_rec) &priority=4 { - if ( ! c?$smtp ) return; + if ( ! c?$smtp || ! c$smtp?$user_agent ) return; if ( h$name == "USER-AGENT" && webmail_user_agents in c$smtp$user_agent ) c$smtp$is_webmail = T; }