Re: Creating a module and accessing an event in another script

Hi Justin,

I can see ACTION_EMAIL on notice.log when running .pcap. But I included the
SSHAttempt module with local.zeek file and if I try to call the notice type
defined in the module inside test.zeek then it doesn't work when I ssh into
the box. Please find attached the files.

Kind regards,
Merril

On Tue, 4 Jun 2019 at 17:38, Justin Azoff <[email protected]> wrote:

> On Tue, Jun 4, 2019 at 12:34 PM Merril Mathew <[email protected]>
> wrote:
>
>> Hi all,
>>
>> But the notice email action does not work though. It generates notice.log
>> but does not email. Any silly mistakes anyone can see?
>>
>
> Are you running against a pcap?  emails are not sent when reading pcap
> files.  You should still  see ACTION_EMAIL in the actions field in the
> notice.log.
>
> --
> Justin
>

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek