While that tag for this notice is defined, it's commented as not implemented. Seth indicated this is because it requires drawing upon distributed information, which doesn't have an apt framework yet. But this is precisely the sort of good-value, non-trivial-behavior notice that Bro should support. Presumably this can be done without requiring extensive inter-cluster-node communication.
This should be possible to implement with Broker's distributed key-value store in 2.5