Re: Creating a module and accessing an event in another script
Justin Azoff <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAPfnCui-TFmPfCqjNtd8Dbon-LJS4kZqSFFqnjaR+KX52bNqmg@mail.gmail.com> |
On Tue, Jun 4, 2019 at 12:54 PM Merril Mathew <[email protected]> wrote: > Hi Justin, > > I can see ACTION_EMAIL on notice.log when running .pcap. But I included > the SSHAttempt module with local.zeek file and if I try to call the notice > type defined in the module inside test.zeek then it doesn't work when I ssh > into the box. Please find attached the files. > If your notice.log shows ACTION_EMAIL then it's working properly. It will not send emails when reading a .pcap file. -- Justin _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek