<!--

- VM-POP3 - Virtual Mail Pop3 decoders

- Author: Daniel Cid.

- Updated by Wazuh, Inc.

- Copyright (C) 2015-2020, Wazuh Inc.

- Copyright (C) 2009 Trend Micro Inc.

- This program is a free software; you can redistribute it and/or modify it under the terms of GPLv2.

-->

<decoder name="vm-pop3d">

<program_name>^vm-pop3d</program_name>

</decoder>

<decoder name="vm-pop3d-fail">

<parent>vm-pop3d</parent>

<prematch>^User '</prematch>

<regex offset="after_prematch">^(\S+)' - \w+ auth, </regex>

<regex>from=(\S+)$</regex>

<order>user, srcip</order>

</decoder>