;COMMENT: Log Blacklisting and Safe-Mail notifications
;DESCRIPTION: Rules to log blacklisting notifications, log Safe-Mail notifications and also blacklist when required by Safe-Mail. Messages are logged to 'blacklst.log' and 'security.log' respectively.

Blacklist-Log	
		Comment = "Log blacklisting events",
		Rule-Action = Log,
		Log-Control = Enabled,
		Log-Mask = "date time direction resolved_source resolved_dest s_port d_port message action_rule",
		Log-File = "firewall/logs/blacklst.log",
		Log-Message = "Blacklisted",
		Log-Severity = Medium,
		Packet-Feature = Blacklist-Trigger

Attachment-Renaming
		Comment = "Log renamed E-mail attachments",
		Packet-Feature = Email-Changed,
		Rule-Action = Log,
		Log-Control = Enabled,
		Log-Message = "E-Mail attachment renamed to '%n' (original: '%o')",
		Log-Severity = Medium,
		Log-Mask = "date time severity direction prot resolved_source resolved_dest message packet_data",

Attachment-Logging
		Comment = "Log allowed E-Mail attachments",
		Packet-Feature = Email-Analyzed,
		Rule-Action = Log,
		Log-Control = Enabled,
		Log-Message = "E-Mail attachment allowed: '%o'",
		Log-Severity = None,
		Log-Mask = "date time severity direction prot resolved_source resolved_dest message packet_data",

Attachment-Relay-Denying
		Comment = "Log E-Mails that failed Relay check",
		Packet-Feature = Email-Relay-Denied,
		Rule-Action = Log,
		Log-Control = Enabled,
		Log-Message = "E-Mail from '%f' to '%t' denied by Safe-Mail Relay Control",
		Log-Severity = Medium,
		Log-Mask = "date time severity direction prot resolved_source resolved_dest message packet_data",

Attachment-Limiting
		Comment = "Log E-Mail that failed Size check",
		Packet-Feature = Email-Limit,
		Rule-Action = Log,
		Log-Control = Enabled,
		Log-Message = "E-Mail from '%f' to '%t' too big, rejected by Safe-Mail",
		Log-Severity = High,
		Log-Mask = "date time severity direction prot resolved_source resolved_dest message packet_data",

Attachment-Denying
		Comment = "Log denied E-Mail attachments",
		Packet-Feature = Email-Denied,
		Rule-Action = Log,
		Log-Control = Enabled,
		Log-Message = "E-Mail attachment from '%f' to '%t' denied: '%o'",
		Log-Severity = Medium,
		Log-Mask = "date time severity direction prot resolved_source resolved_dest message packet_data",

Blacklist-Email-Limit
		Comment = "Safe-Mail SMTP blacklisting",
		Packet-Feature = Email-Limit,
		Rule-Action = Blacklist,
		Log-Control = Enabled,
		Log-Message = "Incoming E-Mail failed size check",
		Log-Severity = High,
		Log-Mask = "date time severity direction prot resolved_source resolved_dest message packet_data",
		Blacklist-Rule = "Blacklist-Limit-Template",

Blacklist-Limit-Template
		Rule-Status = Passive,
		Destination-Port = "25",
		Direction = Incoming,
