diff --git a/scripts/base/frameworks/notice/actions/email_admin.zeek b/scripts/base/frameworks/notice/actions/email_admin.zeek index 96dd40dbb5..2d8c4ba432 100644 --- a/scripts/base/frameworks/notice/actions/email_admin.zeek +++ b/scripts/base/frameworks/notice/actions/email_admin.zeek @@ -18,7 +18,8 @@ export { }; } -hook notice(n: Notice::Info) &priority=-5 +# Run before ACTION_PAGE +hook notice(n: Notice::Info) &priority=5 { if ( |Site::local_admins| > 0 && ACTION_EMAIL_ADMIN in n$actions ) @@ -28,7 +29,7 @@ hook notice(n: Notice::Info) &priority=-5 email = fmt("%s, %s", email, Site::get_emails(n$src)); if ( n?$dst && |Site::get_emails(n$dst)| > 0 ) email = fmt("%s, %s", email, Site::get_emails(n$dst)); - + if ( email != "" ) n$email_dest = email; } diff --git a/scripts/base/frameworks/notice/actions/page.zeek b/scripts/base/frameworks/notice/actions/page.zeek index 473afbeb3a..01c43f53f1 100644 --- a/scripts/base/frameworks/notice/actions/page.zeek +++ b/scripts/base/frameworks/notice/actions/page.zeek @@ -17,7 +17,8 @@ export { option mail_page_dest = ""; } -hook notice(n: Notice::Info) &priority=-6 +# Runs after EMAIL_ADMIN (assume page supercedes), but before hostnames are added. +hook notice(n: Notice::Info) &priority=4 { if ( ACTION_PAGE in n$actions ) n$email_dest = mail_page_dest; diff --git a/scripts/policy/frameworks/notice/extend-email/hostnames.zeek b/scripts/policy/frameworks/notice/extend-email/hostnames.zeek index 8e28200e1c..ad1662b26b 100644 --- a/scripts/policy/frameworks/notice/extend-email/hostnames.zeek +++ b/scripts/policy/frameworks/notice/extend-email/hostnames.zeek @@ -13,7 +13,8 @@ module Notice; # reference to the original notice) global tmp_notice_storage: table[string] of Notice::Info &create_expire=max_email_delay+10secs; -hook notice(n: Notice::Info) &priority=-10 +# Run after e-mail address is set, but before e-mail is sent. +hook notice(n: Notice::Info) &priority=0 { if ( ! n?$src && ! n?$dst ) return;