# Extract links in SMTP

**URL:** <https://community.zeek.org/t/extract-links-in-smtp/2892>\
**Category:** Zeek\
**Created:** [November 7, 2013, 1:53pm UTC](https://community.zeek.org/t/extract-links-in-smtp/2892 "2013-11-07T13:53:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [November 7, 2013, 1:53pm UTC](https://community.zeek.org/t/extract-links-in-smtp/2892/1 "2013-11-07T13:53:57Z")

</div>

Just saw the Extract files from SMTP, and I’d love to be able to extract links from SMTP as well. Many times I have to track down from my http logs a bad link that was gone to…would love to be able to just look for the link in my smtp log to find out if it was clicked on via an email. I too am still a noob at bro, so any assistance with getting something like this to go would be great…thanks all.

James

---

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [November 7, 2013, 6:39pm UTC](https://community.zeek.org/t/extract-links-in-smtp/2892/2 "2013-11-07T18:39:23Z")

</div>

Any chance someone can point me in the right direction with this? My goal is to add an http field in the smtp\_entities file, so I won’t have to create a completely new log file. I have this code (thanks to the gent from the IRC channel):

@load base/protocols/smtp  
@load base/utils

event mime\_entity\_data(c:connection, length: count, data:string)  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{ print find\_all\_urls(data); }

But that’s all I got so far. I’ve spent a good portion of the morning reading the docs at:

[http://www.bro.org/sphinx-beta/scripting/index.html#understanding-bro-scripts](http://www.bro.org/sphinx-beta/scripting/index.html#understanding-bro-scripts)

And I’m still pretty much at the same spot I was at…completely lost :D. My understanding is that I need to create a new .bro script, and then add a redef in my in my local.bro, but that’s the extent of my knowledge at this point. Any help would really be appreciated. Thank you.

James

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/extract-links-in-smtp/2892/3 "2022-05-06T15:41:22Z")

</div>