Hi, what is sent via email can be extended using email_body_sections (see https://www.bro.org/sphinx-git/frameworks/notice.html#extending-notice-emails). In detect-sqli.bro (https://github.com/bro/bro/blob/master/scripts/policy/protocols/http/detect-sqli.bro#L84) you can see how it is used to add additional information. Regards, Jan