example from manual

Zeek
1

http://bro.org/sphinx/notice.html

Where does the example syntax get placed?

2

You could put it in local.bro or a better idea might be to place a new file of your own in <prefix>/share/bro/site/ and and add an "@load myfile" line to local.bro.

Like this…

in <prefix>/share/bro/site/myfile.bro:
  print "hello world";

in <prefix>/share/bro/site/local.bro:
  @load myfile

Are you running Bro with broctl or just running it directly? If you run with broctl, that local.bro script will automatically get loaded (and subsequently load your script).

  .Seth

3

Yes. I am running it via security onion.

4

In the example, if I wanted it to log this info instead of ACTION_EMAIL,
what would I change it too? ACTION_ALARM or ACTION_LOG?

5

All notices are logged by default in notice.log.

  .Seth