feat(smtp_relay): ingest probe_forwarded as probe_relay bounty
Adds probe_forwarded to meaningful event kinds and stores it in the bounty table as bounty_type=probe_relay with forwarded=true/false, so the dashboard shows whether the upstream actually accepted the test email.
This commit is contained in:
@@ -41,6 +41,10 @@ INTERACTION_EVENT_TYPES: frozenset[str] = frozenset({
|
||||
"rcpt_to",
|
||||
"rcpt_denied",
|
||||
"message_accepted",
|
||||
# probe_forwarded fires when we actually relay the test email upstream
|
||||
# so the attacker can verify receipt. forwarded=1 means the upstream
|
||||
# accepted it; forwarded=0 means it failed (but the attacker still got 250).
|
||||
"probe_forwarded",
|
||||
# File / payload activity
|
||||
"file_captured",
|
||||
"upload",
|
||||
|
||||
Reference in New Issue
Block a user