[Bro] Issue defining "Site::local_admins" variable
Azoff, Justin S
jazoff at illinois.edu
Mon May 8 08:39:05 PDT 2017
> On May 8, 2017, at 11:29 AM, Espresso Beanies <espressobeanies at gmail.com> wrote:
>
> Good morning,
>
> I'm working on email separation between users and admins on my local Bro instance and I'm not understanding the syntax for either the "Site::get_emails" or the "Site::local_admins" variables for ACTION_EMAIL_ADMIN. Since I avoid functions, I attempted to redefine the following in my local.bro:
>
> redef Site::local_admins += {
> table([xxx.xxx.xxx.xxx/16] = "emailaddress1 at something.com,emailaddress2 at something.com");
> };
>
> Reference: https://www.bro.org/sphinx/scripts/base/utils/site.bro.html#id-Site::local_admins
>
> Bro doesn't like this and I'm unable to find previous examples for guidance. Could someone point me in the right direction?
It's a table of a set of strings:
scripts/base/utils/site.bro: const local_admins: table[subnet] of set[string] = {} &redef;
$ git grep redef.*local_admins
testing/btest/scripts/base/utils/site.test:redef Site::local_admins += {
$ cat testing/btest/scripts/base/utils/site.test
# @TEST-EXEC: bro %INPUT > output
# @TEST-EXEC: btest-diff output
# This is loaded by default.
#@load base/utils/site
global a = { "site-admin at example.com", "other-site-admin at example.com" };
global b = { "net-admin at example.com" };
redef Site::local_admins += {
[141.142.0.0/16] = a,
[141.142.100.0/24] = b,
};
event bro_init()
{
print Site::get_emails(141.142.1.1);
print Site::get_emails(141.142.100.100);
}
$
--
- Justin Azoff
More information about the Bro
mailing list