# Help with bro scripting exercise question

**URL:** <https://community.zeek.org/t/help-with-bro-scripting-exercise-question/4969>\
**Category:** Zeek\
**Created:** [August 3, 2017, 1:19am UTC](https://community.zeek.org/t/help-with-bro-scripting-exercise-question/4969 "2017-08-03T01:19:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![craig\_bowser](https://avatars.discourse-cdn.com/v4/letter/c/50afbb/32.png) [@craig\_bowser](https://community.zeek.org/u/craig_bowser)\
**Post date:** [August 3, 2017, 1:19am UTC](https://community.zeek.org/t/help-with-bro-scripting-exercise-question/4969/1 "2017-08-03T01:19:47Z")

</div>

Hello all, trying to learn bro scripting. I am working through the exercises from the 2011 workshop and I’m getting an error.

I’m on this page: [https://www.bro.org/bro-workshop-2011/exercises/notices/index.html](https://www.bro.org/bro-workshop-2011/exercises/notices/index.html)

I’m on Pt3 More Advanced Policy Notice running this script:

```auto
const watched_servers: set[addr] = {
172.16.238.136,
172.16.238.168,
} &redef;

redef Notice::policy += {
	[$action = Notice::ACTION_ALARM,
	 $pred(n: Notice::Info) =
		{
		return n$note == SSH::Login && n$id$resp_h in watched_servers;
		}
	]
};

```

```auto
And I'm getting an error that says

#bro -r ssh.pcap local advancebro.bro 
error in ./advancebro.bro, line 10: unknown identifier SSH::Login, at or near "SSH::Login"

```

---

<div class="post-metadata">

**Author:** ![seth](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/seth/32/642_2.png) [@seth](https://community.zeek.org/u/seth)\
**Post date:** [August 3, 2017, 1:54am UTC](https://community.zeek.org/t/help-with-bro-scripting-exercise-question/4969/2 "2017-08-03T01:54:50Z")

</div>

Sorry that code is out of date! Quite a few years have passed since  
that workshop. Are you just trying to go through the workshop code or  
are you actually trying to achieve a particular behavior? If you're  
trying to achieve a behavior, I can help you out with the more modern  
way to do that if you'd like. If you are just trying to go through  
the workshop code then I'd say to just skip that one. 🙂

Have you look at the exercises on [http://try.bro.org/](http://try.bro.org/)?

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![craig\_bowser](https://avatars.discourse-cdn.com/v4/letter/c/50afbb/32.png) [@craig\_bowser](https://community.zeek.org/u/craig_bowser)\
**Post date:** [August 3, 2017, 2:54am UTC](https://community.zeek.org/t/help-with-bro-scripting-exercise-question/4969/3 "2017-08-03T02:54:24Z")

</div>

I’m trying to do several things. My main goal is to learn how to script so I can build notices and alerts based on threats specific to my environment.

Right now, I’m trying to figure out how to get bro to send an email when it generates a notice.

I’ve been looking at this page:

[https://www.bro.org/sphinx-git/frameworks/notice.html](https://www.bro.org/sphinx-git/frameworks/notice.html)

and this page:

[https://www.bro.org/sphinx-git/scripts/base/frameworks/notice/main.bro.html](https://www.bro.org/sphinx-git/scripts/base/frameworks/notice/main.bro.html)

and this email from the archive:

[http://mailman.icsi.berkeley.edu/pipermail/bro/2014-October/007621.html](http://mailman.icsi.berkeley.edu/pipermail/bro/2014-October/007621.html)

and this reference from a google search:

[https://books.google.com/books?id=TTIDAQAAQBAJ&pg=PA283&lpg=PA283&dq=Notice::mail\_dest&source=bl&ots=Uw\_GRZCI2Q&sig=lzDZWVnDNdfIuFaRP16OWgXvk-4&hl=en&sa=X&ved=0ahUKEwinzbCT97nVAhUC7IMKHaBzDjkQ6AEIPTAE](https://books.google.com/books?id=TTIDAQAAQBAJ&pg=PA283&lpg=PA283&dq=Notice::mail_dest&source=bl&ots=Uw_GRZCI2Q&sig=lzDZWVnDNdfIuFaRP16OWgXvk-4&hl=en&sa=X&ved=0ahUKEwinzbCT97nVAhUC7IMKHaBzDjkQ6AEIPTAE)

But my attempt at putting all of that together using the example script from the aforementioned 2011 exercise isn’t working…

#redef Notice::alarmed\_types += {  
#SSH::Password\_Guessing  
#};  
redef Notice::ignored\_types += {  
};

redef Notice::mail\_dest = “[reswob10@gmail.com](mailto:reswob10@gmail.com)”;

hook Notice::policy(n: Notice::Info)  
{  
if ( n$note == SSH::Password\_Guessing )  
add n$actions[Notice::ACTION\_EMAIL];  
}

Any direction you can provide would be helpful.

And yes, I’ve gone through most of those exercises at [try.bro.org](http://try.bro.org), but they don’t cover how to send notices via email.

Thanks.

Craig

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/help-with-bro-scripting-exercise-question/4969/4 "2022-05-06T15:45:10Z")

</div>