From c74effad429c19b587d81ff64ddaa94a66a4f95d Mon Sep 17 00:00:00 2001 From: Robin Sommer Date: Fri, 27 May 2016 13:22:24 -0700 Subject: [PATCH] Clarifying notice documentation. Closes BIT-1405. --- doc/frameworks/notice.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/doc/frameworks/notice.rst b/doc/frameworks/notice.rst index eacf9c917f..e37740dee1 100644 --- a/doc/frameworks/notice.rst +++ b/doc/frameworks/notice.rst @@ -83,9 +83,9 @@ The hook :bro:see:`Notice::policy` provides the mechanism for applying actions and generally modifying the notice before it's sent onward to the action plugins. Hooks can be thought of as multi-bodied functions and using them looks very similar to handling events. The difference -is that they don't go through the event queue like events. Users should -directly make modifications to the :bro:see:`Notice::Info` record -given as the argument to the hook. +is that they don't go through the event queue like events. Users can +alter notice processing by directly modifying fields in the +:bro:see:`Notice::Info` record given as the argument to the hook. Here's a simple example which tells Bro to send an email for all notices of type :bro:see:`SSH::Password_Guessing` if the guesser attempted to log in to