[Bro] Question on quick start documentation SSH:Login example.

Justin Azoff JAzoff at albany.edu
Tue Aug 5 07:31:22 PDT 2014

On Tue, Aug 05, 2014 at 03:28:31PM +0200, nithen wrote:
> hook Notice::policy(n: Notice::Info)
>     {
>     if ( n$note == SSH::SUCCESSFUL_LOGIN && n$id$resp_h in watched_servers )
>          add n$actions[Notice::ACTION_EMAIL];
>     }

Looks like the quickstart is a bit off here..

That used to use SSH::Login but was changed to SSH::SUCCESSFUL_LOGIN,
but SSH::SUCCESSFUL_LOGIN is a Intel::Where and not a Notice::Type.

There's no ssh login notice anymore, so I don't think there is an easy
fix here to accomplish the same thing.

-- Justin Azoff

More information about the Bro mailing list