Send email on any SSH attempt
Merril Mathew <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAPqihfwPkfgvpU897P2eM+ottZAvMMup3Lv1sMs6tiCcYvZ=yA@mail.gmail.com> |
Hi All, I am very new to Zeek. I was trying to send an email on any SSH attempt, regardless of success or fail. The notice framework is really confusing and I could not find much information online. :) Would be great if someone can explain to me what I need to do to solve this specific issue. Please find attached what I have tried so far. Please also note that whenever I tried to run my scripts with pcap file it generates a notice.log. However if I load my script to local.zeek then I cannot find any notice.log in $PREFIX/bro/logs/current. zeek_mail.zeek is where the Notice implementation is done and zeek_mail2.zeek is where the notice hook is applied. Kind regards, Merril. _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
zeek_mail2.zeek
(application/octet-stream, 225 B) - not displayed
zeek_mail.zeek
(application/octet-stream, 353 B) - not displayed