# question about send\_email\_notice

**URL:** https://community.zeek.org/t/question-about-send-email-notice/1130
**Category:** Zeek
**Created:** [February 20, 2007, 7:53pm UTC](https://community.zeek.org/t/question-about-send-email-notice/1130 "2007-02-20T19:53:45Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Cuttler\_Matt](https://avatars.discourse-cdn.com/v4/letter/c/c0e974/32.png) [@Cuttler\_Matt](https://community.zeek.org/u/Cuttler_Matt)
#### Post date: [February 20, 2007, 7:53pm UTC](https://community.zeek.org/t/question-about-send-email-notice/1130/1 "2007-02-20T19:53:45Z")

</div>

Bro users and developers,

We have modified our notice action filters; some notices/alerts get sent  
via email (while others only get logged to file\_notice).

A small snippet:

redef notice\_action\_filters += {  
[[AddressScan, PortScan, PasswordGuessing]] = send\_email\_notice,  
};

redef notice\_action\_filters += {  
[[ProtocolDetector::ProtocolFound, ProtocolDetector::ServerFound]] =  
file\_notice,  
};

My question is: Is it easily possible to place additional information in  
the email notices themselves?

For example, an AddressScan mail might simply say, "10.11.12.13 has  
scanned 100 hosts (45653/tcp)". It would save a log of analyst time  
("grep time" if you will) if the mail included the hosts which were  
considered scanned by Bro.

Thanks,  
Matt Cuttler

---

<div class="post-metadata">

### Author: ![Brian\_Tierney](https://avatars.discourse-cdn.com/v4/letter/b/13edae/32.png) [@Brian\_Tierney](https://community.zeek.org/u/Brian_Tierney)
#### Post date: [February 22, 2007, 3:35am UTC](https://community.zeek.org/t/question-about-send-email-notice/1130/2 "2007-02-22T03:35:26Z")

</div>

My solution to this was to modify the email\_notice function in  
notice.bro as follows:

function email\_notice(n: notice\_info, action: NoticeAction,  
&nbsp;&nbsp;&nbsp;&nbsp;info: string)  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if ( ! reading\_live\_traffic() || mail\_dest == "" )  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# Choose destination address based on action type.  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;local destination = (action == NOTICE\_EMAIL) ?  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;mail\_dest : mail\_page\_dest;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;local mail\_cmd = "";

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (detailed\_email)  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# this version assumes script to generate more detailed Alarm  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;mail\_cmd = fmt("echo \"%s\" \| %s %s", info,  
&nbsp;&nbsp;&nbsp;&nbsp;mail\_script, destination);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;else # this version assumes simple Alarm sent  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# directly to Mail command  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;mail\_cmd = fmt("echo \"%s\" | %s -s \"[Bro Alarm] %s\" %s",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;n$msg, mail\_script, n$note, destination);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;system(mail\_cmd);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}

---

<div class="post-metadata">

### Author: ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/question-about-send-email-notice/1130/3 "2022-05-06T15:38:10Z")

</div>