# creating bro scripts

**URL:** <https://community.zeek.org/t/creating-bro-scripts/2777>\
**Category:** Zeek\
**Created:** [August 14, 2013, 3:07pm UTC](https://community.zeek.org/t/creating-bro-scripts/2777 "2013-08-14T15:07:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_Babio1](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@John\_Babio1](https://community.zeek.org/u/John_Babio1)\
**Post date:** [August 14, 2013, 3:07pm UTC](https://community.zeek.org/t/creating-bro-scripts/2777/1 "2013-08-14T15:07:07Z")

</div>

Thanks Anthony,  
Here is what I have so far. How do I create a notice out of it?

event dns\_request(c: connection, msg: dns\_msg, query: string, qtype: count, qclass: count) &priority=5  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if ( c$dns$qtype == PTR )  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return;  
}

---

<div class="post-metadata">

**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\
**Post date:** [August 14, 2013, 3:20pm UTC](https://community.zeek.org/t/creating-bro-scripts/2777/2 "2013-08-14T15:20:13Z")

</div>

See the ‘raising notices’ section here  
[http://bro.org/sphinx/notice.html](http://bro.org/sphinx/notice.html)

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/creating-bro-scripts/2777/3 "2022-05-06T15:41:09Z")

</div>