Scan ports doubt

Hello, Community.

I've a problem with scan ports:

    I'm working on a script to detect ports scan (horizontal and
vertical) using scan.bro script and I send email when detected. I've a
question with Notice::policy executions times.
I do a scan to IP's ports (e.g. from a specific IP (e.g. If scan detected first time, send email, but if I do another
scan to same IP ( from, Notice::policy hook
doesn't execute again.
If I do nmap scan from another IP (e.g. to,
occurs same problem: It only detects first time executing Notice::policy.

I would like to change this options but I can't find how to do it.

Thank you and I'm sorry for my English.

Duplicate notices are suppressed so that you don't get notified about the same event over and over again.

Try something like this in your local.bro

    redef Notice::type_suppression_intervals += {
        [Scan::Port_Scan] = 60sec,
        [Scan::Address_Scan] = 60sec,

Perfect. Works fine.

Thank you.