Add FORGED_SENDER_MAILLIST composite.

diff --git a/conf/composites.conf b/conf/composites.conf
index a8fe1ae4a3ee28d47b437fb682d907f2812b3f52..abb43f502949f17680dc1f6cb7254507c2054852 100644 (file)
--- a/conf/composites.conf
+++ b/conf/composites.conf
@@ -4,6 +4,10 @@ composite {
     name = "FORGED_RECIPIENTS_MAILLIST";
     expression = "FORGED_RECIPIENTS & -MAILLIST";
 }
+composite {
+    name = "FORGED_SENDER_MAILLIST";
+    expression = "FORGED_SENDER & -MAILLIST";
+}
 composite {
     name = "FORGED_MUA_OUTLOOK_MAILLIST";
     expression = "FORGED_MUA_OUTLOOK and MAILLIST";

diff --git a/conf/metrics.conf b/conf/metrics.conf
index 1d2e8ce30beea73057f9e412d872f04e98630bb1..06788052af6f8fc32797dd55ddf2b566382de54f 100644 (file)
--- a/conf/metrics.conf
+++ b/conf/metrics.conf
@@ -298,9 +298,14 @@ metric {
     }
     symbol {
         weight = 0.0;
-        description = "Recipients are not the same as RCPT TO: mail command, but from maillist";
+        description = "Recipients are not the same as RCPT TO: mail command, but a message from a maillist";
         name = "FORGED_RECIPIENTS_MAILLIST";
     }
+    symbol {
+        weight = 0.0;
+        description = "Sender is not the same as MAIL FROM: envelope, but a message is from a maillist";
+        name = "FORGED_SENDER_MAILLIST";
+    }
     symbol {
         weight = 2.0;
         description = "Forged Exchange messages ";