Bro extract SMTP data (eml), cache in Redis

smtp-data.bro

@load base/protocols/conn
@load base/protocols/smtp

event mime_all_data(c: connection, length: count, data: string)
{
    local conn_key: string;
    local cmd: string;

    if ( ! c?$smtp )
        return;

    conn_key = cat(c$smtp$uid, "_", c$smtp$trans_depth);
    cmd = "/usr/bin/redis-cli -n 2 ";
    cmd = cat(cmd, "SETEX '", conn_key, "' 259200 '", encode_base64(data), "'");
    when ( local res = Exec::run([$cmd=cmd])) {}
}