From 22add9a7ae3260e5d92e0c11e6811f61d35ee177 Mon Sep 17 00:00:00 2001
From: Sascha Rommelfangen <sascha@rommelfangen.de>
Date: Fri, 30 Jun 2017 08:45:25 +0200
Subject: [PATCH] clarifications

---
 README.md | 66 ++++++++++++++++++++++++++++---------------------------
 1 file changed, 34 insertions(+), 32 deletions(-)

diff --git a/README.md b/README.md
index 7618b92..ccc7350 100644
--- a/README.md
+++ b/README.md
@@ -31,20 +31,45 @@ Connect your mail infrastructure to [MISP](https://github.com/MISP/MISP) in orde
 
 For the moment, the implemented workflow is:
 
-1. Apple Mail
-
-`Email -> Apple Mail -> Mail rule -> AppleScript -> mail_to_misp -> PyMISP -> MISP`
-
-2. Mozilla Thunderbird
-
-`Email -> Thunderbird -> Mail rule -> filterscript -> thunderbird_wrapper -> mail_to_misp -> PyMISP -> MISP`
-
-3. Postfix and others
+1. Postfix and others
 
 `Email -> mail_to_misp`
 
+2. Apple Mail
+
+`Email -> Apple Mail -> Mail rule -> AppleScript -> mail_to_misp -> PyMISP -> MISP`
+
+3. Mozilla Thunderbird
+
+`Email -> Thunderbird -> Mail rule -> filterscript -> thunderbird_wrapper -> mail_to_misp -> PyMISP -> MISP`
+ 
+
 ## Installation
 
+### Postfix (or other MTA) - preferred method
+
+1. Setup a new email address in the aliases file (e.g. /etc/aliases) and configure the correct path:
+
+`misp_handler: "|/path/to/mail_to_misp.py"`
+
+2. Rebuild the DB:
+
+`$ sudo newaliases`
+
+3. Configure mail_to_misp_config.py
+
+You should now be able to send your IoC-containing mails to misp_handler@YOURDOMAIN.
+
+#### Bonus: Fake-SMTPD spamtrap
+
+If you want to process all incoming junk mails automatically and collect the contained information in a (separate?) MISP instance, you could use the fake_smtp.py script. It listens on port 25, accepts all mails and pushes them through mail_to_misp to a MISP instance.
+
+1. Configure mail_to_misp_config.py
+
+2. Run fake_smtp.py (as root)
+
+`$ sudo python3 fake_smtp.py`
+
 ### Apple Mail
 
 1. Mail rule script
@@ -92,29 +117,6 @@ pythoncom.PumpMessages()
 
 Obviously, you would like to filter mails based on subject or from address and pass subject and body to mail_to_misp.py in order to do something useful. Pull-requests welcome for actual implementations :) 
 
-### Postfix (or other MTA)
-
-1. Setup a new email address in the aliases file (e.g. /etc/aliases) and configure the correct path:
-
-`misp_handler: "|/path/to/mail_to_misp.py"`
-
-2. Rebuild the DB:
-
-`$ sudo newaliases`
-
-3. Configure mail_to_misp_config.py
-
-You should now be able to send your IoC-containing mails to misp_handler@YOURDOMAIN.
-
-### Fake-SMTPD spamtrap
-
-If you want to process all incoming junk mails automatically and collect the contained information in a (separate?) MISP instance, you could use the fake_smtp.py script. It listens on port 25, accepts all mails and pushes them through mail_to_misp to a MISP instance.
-
-1. Configure mail_to_misp_config.py
-
-2. Run fake_smtp.py (as root)
-
-`$ sudo python3 fake_smtp.py`
 
 ## Requirements