Email Notice Suppression

Hi All,

I'm running bro 2.4 and have just added a bunch of critical stack intel
feeds. All is working well.

One of the feeds I have is a list of TOR ips, and once I set notices to
true for the critical stack intel I start getting emails (I've set up
email alerting for notices).

What I would like to do is suppress email alerts for a particular notice
from a particular src host.

ie (intel.log):

1441063489.889373 CEyDP6zbg6ngOFFa 45969 443 - - -
Intel::ADDR Conn::IN_RESP sensor-eth1-1 from via

So any notice that fires from src for the torlist intel -
I'd still like to see the notice in the intel file - but not get the
email alert.

Any pointers?



Hi Scotty,

have a look at automated suppression and the Notice::policy hook ( and

If you use the do_notice script that comes with Bro, you want to add an identifier to the notice, to get automated suppression.

Best regards,