Add FORGED_SENDER_MAILLIST composite.

2 files changed, 10 insertions, 1 deletions

diff --git a/conf/composites.conf b/conf/composites.conf
index a8fe1ae4a..abb43f502 100644
--- a/conf/composites.conf
+++ b/conf/composites.conf
@@ -5,6 +5,10 @@ composite {
     expression = "FORGED_RECIPIENTS & -MAILLIST";
 }
 composite {
+    name = "FORGED_SENDER_MAILLIST";
+    expression = "FORGED_SENDER & -MAILLIST";
+}
+composite {
     name = "FORGED_MUA_OUTLOOK_MAILLIST";
     expression = "FORGED_MUA_OUTLOOK and MAILLIST";
 }
diff --git a/conf/metrics.conf b/conf/metrics.conf
index 1d2e8ce30..06788052a 100644
--- a/conf/metrics.conf
+++ b/conf/metrics.conf
@@ -298,10 +298,15 @@ metric {
     }
     symbol {
         weight = 0.0;
-        description = "Recipients are not the same as RCPT TO: mail command, but from maillist";
+        description = "Recipients are not the same as RCPT TO: mail command, but a message from a maillist";
         name = "FORGED_RECIPIENTS_MAILLIST";
     }
     symbol {
+        weight = 0.0;
+        description = "Sender is not the same as MAIL FROM: envelope, but a message is from a maillist";
+        name = "FORGED_SENDER_MAILLIST";
+    }
+    symbol {
         weight = 2.0;
         description = "Forged Exchange messages ";
         name = "RATWARE_MS_HASH";