[Bro] Question on quick start documentation SSH:Login example.
JAzoff at albany.edu
Tue Aug 5 07:31:22 PDT 2014
On Tue, Aug 05, 2014 at 03:28:31PM +0200, nithen wrote:
> hook Notice::policy(n: Notice::Info)
> if ( n$note == SSH::SUCCESSFUL_LOGIN && n$id$resp_h in watched_servers )
> add n$actions[Notice::ACTION_EMAIL];
Looks like the quickstart is a bit off here..
That used to use SSH::Login but was changed to SSH::SUCCESSFUL_LOGIN,
but SSH::SUCCESSFUL_LOGIN is a Intel::Where and not a Notice::Type.
There's no ssh login notice anymore, so I don't think there is an easy
fix here to accomplish the same thing.
-- Justin Azoff
More information about the Bro