diff --git a/scripts/base/frameworks/notice/actions/email_admin.zeek b/scripts/base/frameworks/notice/actions/email_admin.zeek index 1b02e5ff0c..02b25d7c21 100644 --- a/scripts/base/frameworks/notice/actions/email_admin.zeek +++ b/scripts/base/frameworks/notice/actions/email_admin.zeek @@ -33,3 +33,8 @@ hook notice(n: Notice::Info) &priority=-5 email_notice_to(n, email, T); } } + +# If hostnames.zeek was loaded first, add ourselves +@ifdef ( email_with_hostnames_types ) +redef email_with_hostnames_types += { ACTION_EMAIL_ADMIN }; +@endif diff --git a/scripts/base/frameworks/notice/actions/page.zeek b/scripts/base/frameworks/notice/actions/page.zeek index 99ca44537b..0a83a8d4bc 100644 --- a/scripts/base/frameworks/notice/actions/page.zeek +++ b/scripts/base/frameworks/notice/actions/page.zeek @@ -11,7 +11,7 @@ export { ## variable. ACTION_PAGE }; - + ## Email address to send notices with the :zeek:enum:`Notice::ACTION_PAGE` ## action. option mail_page_dest = ""; @@ -22,3 +22,8 @@ hook notice(n: Notice::Info) &priority=-5 if ( ACTION_PAGE in n$actions ) email_notice_to(n, mail_page_dest, F); } + +# If hostnames.zeek was loaded first, add ourselves +@ifdef ( email_with_hostnames_types ) +redef email_with_hostnames_types += { ACTION_PAGE }; +@endif diff --git a/scripts/policy/frameworks/notice/extend-email/hostnames.zeek b/scripts/policy/frameworks/notice/extend-email/hostnames.zeek index 5be74c7913..9d079d80af 100644 --- a/scripts/policy/frameworks/notice/extend-email/hostnames.zeek +++ b/scripts/policy/frameworks/notice/extend-email/hostnames.zeek @@ -1,12 +1,20 @@ -##! Loading this script extends the :zeek:enum:`Notice::ACTION_EMAIL` action +##! Loading this script extends the emails that Zeek sends ##! by appending to the email the hostnames associated with ##! :zeek:type:`Notice::Info`'s *src* and *dst* fields as determined by a -##! DNS lookup. +##! DNS lookup. This is enabled for the :zeek:enum:`Notice::ACTION_EMAIL` +##! action by default, and :zeek:enum:`Notice::ACTION_EMAIL_ADMIN` and +##! :zeek:enum:`Notice::ACTION_PAGE` if their scripts are loaded. @load base/frameworks/notice/main module Notice; +export { + ## The Notice action types whose e-mails will be extended with hostnames. + ## :zeek:see:`Notice::Action` + option email_with_hostnames_types: set[Notice::Action] = {ACTION_EMAIL}; +} + # We have to store references to the notices here because the when statement # clones the frame which doesn't give us access to modify values outside # of it's execution scope. (we get a clone of the notice instead of a @@ -19,7 +27,8 @@ hook notice(n: Notice::Info) &priority=10 return; # This should only be done for notices that are being sent to email. - if ( ACTION_EMAIL !in n$actions ) + # We calculate the intersection, and don't do anything if it's empty. + if ( |n$actions & email_with_hostnames_types| == 0 ) return; # I'm not recovering gracefully from the when statements because I want @@ -50,3 +59,13 @@ hook notice(n: Notice::Info) &priority=10 } } } + +# If page.zeek was loaded first, add that action +@ifdef ( ACTION_PAGE ) +redef email_with_hostnames_types += { ACTION_PAGE }; +@endif + +# If email_admin.zeek was loaded first, add that action +@ifdef ( ACTION_EMAIL_ADMIN ) +redef email_with_hostnames_types += { ACTION_EMAIL_ADMIN }; +@endif