[Bro] Bro email notice question

[Jan Grashöfer]

Hi Scotty,

> Thank you!  This is exactly what I was after.  I did have to add a
> missing closing bracket ) to line 39.

You are welcome! I fixed the bracket as well as the misleading
indentation of the script.

> Did you ever have any discussion on getting this added/changed to the
> default do_notice that is distributed with bro?

If I remember correctly, the intention of do_notice.bro was to provide
an example how the intel-framework could be used in this context. I
think the example somehow became the default. Therefore I was not sure
whether these changes would be suited for the do_notice.bro shipped with
Bro.

Regards,
Jan