customize msg in a Notice hook

Zeek
1

How would one go about customizing the message for a notice when it matches specific criteria?

Here’s what I’ve tried:

hook Notice::policy(n: Notice::Info)
{
if ( n$note == && )
add n$actions[Notice::ACTION_EMAIL];
n$msg=;
}

However, that changes the message for every notice in the notice log… is there a way to scope that so it changes the message only for that one notice instance?

Thanks,

Matt

2

You need to use curly braces to make a compound statement, otherwise that last statement is unconditional. E.g.:

  if ( … criteria ... )
    {
    add n$action[…];
    n$msg = …;
    }

- Jon

3

Ahh, so simple and so right.

Thanks!

-matt