# Two questions

**URL:** <https://community.zeek.org/t/two-questions/4492>\
**Category:** Zeek\
**Created:** [November 17, 2016, 4:39pm UTC](https://community.zeek.org/t/two-questions/4492 "2016-11-17T16:39:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eugene\_Dautzenberg](https://avatars.discourse-cdn.com/v4/letter/e/9de0a6/32.png) [@Eugene\_Dautzenberg](https://community.zeek.org/u/Eugene_Dautzenberg)\
**Post date:** [November 17, 2016, 4:39pm UTC](https://community.zeek.org/t/two-questions/4492/1 "2016-11-17T16:39:14Z")

</div>

I setup a Bro instance on a Raspberry Pi3 with an WLAN monitor interface, for IDS home use.

I got notices and with the

hook Notice::policy(n: Notice::Info)  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;add n$actions[Notice::ACTION\_EMAIL];  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}

config (example from the mailing list) into my local.bro.I got notices by mail. Works fine.

I also installed critical stack intel feeds, and when I see an Intel file created when I test a banned ip address.

I am new to Bro and have no knowlegde about Bro configuration and scripting language. But I want to make a quickstart

I have two questions:

1: How can the intel also get mailed, when an intel event occurs?  
I tried

redef Notice::emailed\_types += {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;HTTP::IN\_HOST\_HEADER,  
};

Config check is ok but after triggering an intel event I got no mail.

2: I want to incorporate a Bash curl script send alerts to other systems when a notice or an intel event occurs. How to accomplish this?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [November 29, 2016, 11:35pm UTC](https://community.zeek.org/t/two-questions/4492/2 "2016-11-29T23:35:05Z")

</div>

Hi,

> 1: How can the intel also get mailed, when an intel event occurs?  
> I tried
> 
> redef Notice::emailed\_types += {  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;HTTP::IN\_HOST\_HEADER,  
> };

HTTP::IN\_HOST\_HEADER actually is not a notice type; it is a location of  
the Intel framework. Try using Intel::Notice instead, that should work.

> 2: I want to incorporate a Bash curl script send alerts to other systems when a notice or an intel event occurs. How to accomplish this?

You probably want to use the exec framework -  
[https://www.bro.org/sphinx/scripts/base/utils/exec.bro.html](https://www.bro.org/sphinx/scripts/base/utils/exec.bro.html).

I hope this helps,  
Johanna

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/two-questions/4492/3 "2022-05-06T15:44:18Z")

</div>