@load base/protocols/ssh/ @load base/frameworks/notice @load /usr/local/bro/share/bro/site/alert_ssh_attempt.bro hook Notice::policy(n: Notice::Info) { if ( n$note==SSH::Login_Attempted ) add n$actions[Notice::ACTION_EMAIL]; }