@load base/protocols/ssh @load /usr/local/bro/share/bro/site/alert_ssh_attempt.zeek hook Notice::policy(n: Notice::Info) { if ( n$note == SSH::Login_Attempted ) add n$actions[Notice::ACTION_EMAIL]; }