# bro email notifications

**URL:** <https://community.zeek.org/t/bro-email-notifications/976>\
**Category:** Zeek\
**Created:** [June 23, 2006, 11:44am UTC](https://community.zeek.org/t/bro-email-notifications/976 "2006-06-23T11:44:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Smith\_Stephen\_G\_OIG](https://avatars.discourse-cdn.com/v4/letter/s/f9ae1b/32.png) [@Smith\_Stephen\_G\_OIG](https://community.zeek.org/u/Smith_Stephen_G_OIG)\
**Post date:** [June 23, 2006, 11:44am UTC](https://community.zeek.org/t/bro-email-notifications/976/1 "2006-06-23T11:44:21Z")

</div>

Hi all,

I am working with the DNS module, and trying change the notification for  
some of the alerts. Specifically, I would like to set the  
SensitiveDNS\_Lookup alarm to NOTICE\_EMAIL rather than  
NOTICE\_ALARM\_ALWAYS as is default. I got that name for the event by  
parsing the alarm file and looking at the events from the dns module.  
Following the example in Sec6.3 of the User Manual I put

\<snip\>  
redef notice\_action\_filters += {  
[[SensitiveDNS\_Lookup]] = send\_email\_notice,  
};  
\</snip\>

in my local.site.bro file. However when trying to start that gives me

\<snip\>  
BRO# ../etc/bro.rc start  
bro.rc: Running as non-root user bro  
bro.rc: Starting ..........bro.rc: Failed to start Bro  
/usr/local/bro/site/local.site.bro, line 21: error: unknown identifier  
SensitiveDNS\_Lookup, at or near "SensitiveDNS\_Lookup"  
... FAILED  
\</snip\>

Any ideas? Please let me know if there is any more info I should  
provide.

Thanks,  
Steve

---

<div class="post-metadata">

**Author:** ![Brian\_Tierney](https://avatars.discourse-cdn.com/v4/letter/b/13edae/32.png) [@Brian\_Tierney](https://community.zeek.org/u/Brian_Tierney)\
**Post date:** [June 23, 2006, 1:23pm UTC](https://community.zeek.org/t/bro-email-notifications/976/2 "2006-06-23T13:23:38Z")

</div>

If you look at dns.bro, you will see:

module DNS;

This means you must append "DNS::" to all variable defined there. ie:  
DNS::SensitiveDNS\_Lookup

Smith, Stephen G., OIG DoD wrote:

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/bro-email-notifications/976/3 "2022-05-06T15:37:53Z")

</div>