# bro intel notice log

**URL:** <https://community.zeek.org/t/bro-intel-notice-log/4747>\
**Category:** Zeek\
**Created:** [March 27, 2017, 7:27pm UTC](https://community.zeek.org/t/bro-intel-notice-log/4747 "2017-03-27T19:27:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alex\_Kefallonitis](https://avatars.discourse-cdn.com/v4/letter/a/f9ae1b/32.png) [@Alex\_Kefallonitis](https://community.zeek.org/u/Alex_Kefallonitis)\
**Post date:** [March 27, 2017, 7:27pm UTC](https://community.zeek.org/t/bro-intel-notice-log/4747/1 "2017-03-27T19:27:27Z")

</div>

Critical stack module is up and running and generates intel logs. I want bro to send email when an indicator is seen . Although i receive mail from bro for notices and i added do\_notice.bro to local.bro i never seen a notice intel email or log. Any advice?

I also try adding these to local.bro

redef Notice::emailed\_types += {  
Intel::Notice,  
Intel::DOMAIN,  
TeamCymruMalwareHashRegistry::Match,  
Software::Vulnerable\_Version,  
Traceroute::Detected,  
Scan::Address\_Scan,  
Scan::Port\_Scan,  
Conn::Content\_Gap,  
DNS::External\_Name,  
FTP::Bruteforcing,  
FTP::Site\_Exec\_Success,  
HTTP::SQL\_Injection\_Attacker,  
HTTP::SQL\_Injection\_Victim,  
SMTP::Blocklist\_Error\_Message,  
SMTP::Blocklist\_Blocked\_Host,  
SMTP::Suspicious\_Origination,  
SSH::Password\_Guessing,  
SSH::Login\_By\_Password\_Guesser,  
SSH::Watched\_Country\_Login,  
SSH::Interesting\_Hostname\_Login,  
SSL::Certificate\_Expired,  
SSL::Certificate\_Expires\_Soon,  
SSL::Certificate\_Not\_Valid\_Yet,  
Heartbleed::SSL\_Heartbeat\_Attack,  
Heartbleed::SSL\_Heartbeat\_Attack\_Success,  
Heartbleed::SSL\_Heartbeat\_Odd\_Length,  
Heartbleed::SSL\_Heartbeat\_Many\_Requests,  
};

hook Notice::policy(n: Notice::Info)  
{  
add n$actions[Notice::ACTION\_EMAIL];  
}

but nothing changed

---

<div class="post-metadata">

**Author:** ![Alex\_Kefallonitis](https://avatars.discourse-cdn.com/v4/letter/a/f9ae1b/32.png) [@Alex\_Kefallonitis](https://community.zeek.org/u/Alex_Kefallonitis)\
**Post date:** [March 28, 2017, 7:24am UTC](https://community.zeek.org/t/bro-intel-notice-log/4747/2 "2017-03-28T07:24:53Z")

</div>

I want bro to send email notification on all notices…but i can’t get intel to notice log i can’t figure out what i am doing wrong

---

<div class="post-metadata">

**Author:** ![Alex\_Kefallonitis](https://avatars.discourse-cdn.com/v4/letter/a/f9ae1b/32.png) [@Alex\_Kefallonitis](https://community.zeek.org/u/Alex_Kefallonitis)\
**Post date:** [March 28, 2017, 9:04am UTC](https://community.zeek.org/t/bro-intel-notice-log/4747/3 "2017-03-28T09:04:36Z")

</div>

Update i also tried loading critical stack manually on local.bro

hook Notice::policy(n: Notice::Info)  
{  
add n$actions[Notice::ACTION\_EMAIL];  
}

@load base/frameworks/intel  
@load frameworks/intel/seen  
@load frameworks/intel/do\_notice

redef Intel::read\_files += {  
“/opt/critical-stack/frameworks/intel/master-public.bro.dat”  
};

I get no errors i have intel logs but no notice and emails like do\_notice doesn’t work…

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/bro-intel-notice-log/4747/4 "2022-05-06T15:44:46Z")

</div>