id: data_from_docmeta
version: 1
meta:
  name: Data was found within document/image meta data
  description: >
    Possibly interesting data was found within document/image meta data,
    such as software versions, names, email addresses and hostnames.
  risk: INFO
collections:
  - collect:
      - method: exact
        field: type
        value: RAW_FILE_META_DATA
      - method: regex
        field: child.data
        value: .*
      - method: exact
        field: child.type
        value: not HASH
aggregation:
  field: child.data
headline: "Interesting data was found within document meta data: '{child.data}'"
