Intel framework does not match mail addresses properly

Description

Some time ago someone in #bro asked for matching mail addresses using the intel-framework. We realized, that the seen-script seems to contain a bug: Using

to extract a mail address misses the last character and does not respect the possibility of multiple addresses.

I will add a pcap later.

Environment

All

Assignee

Seth Hall

Reporter

Jan Grashoefer

Labels

External issue ID

None

Components

Fix versions

Affects versions

Priority

Low
Configure