From 048369fbebb801f3d163ccf5fd52ec5eefa260d8 Mon Sep 17 00:00:00 2001
From: Seth Hall <seth@icir.org>
Date: Sat, 6 Aug 2011 00:33:58 -0400
Subject: [PATCH] The hostname notice email extension now only add hostnames
 for emailed noticed.

---
 scripts/base/frameworks/notice/extend-email/hostnames.bro | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/base/frameworks/notice/extend-email/hostnames.bro b/scripts/base/frameworks/notice/extend-email/hostnames.bro
index e7c7470b3c..83cdc4807d 100644
--- a/scripts/base/frameworks/notice/extend-email/hostnames.bro
+++ b/scripts/base/frameworks/notice/extend-email/hostnames.bro
@@ -7,6 +7,10 @@ event Notice::notice(n: Notice::Info) &priority=10
 	if ( ! n?$src && ! n?$dst )
 		return;
 	
+	# This should only be done for notices that are being sent to email.
+	if ( ACTION_EMAIL !in n$action )
+		return;
+		
 	local output = "";
 	if ( n?$src )
 		{