Header directives in the white training section of GBUdb provide a mechanism for improving IP statistics based on message headers. When a white header directive fires GBUdb will record a good event for the message source.

Here is an example usually commented out in the default snf_engine.xml file:

<header name='Received:' ordinal='0' find='.friendlyhost.com'/> 

The name='Received:' attribute indicates that we are looking for a Received header.

The ordinal='0' attribute indicates that we are looking for the first instance (ordinal 0) of the header.

The find='.friendlyhost.com' attribute indicates that we must find the string .friendlyhost.com in order to activate this header directive.

The result of this header directive would be to record good GBUdb events for all messages where .friendlyhost.com is found in the top Received header.

Please email support@armresearch.com with any questions.