[ossec-list] Re: Composite Rule Help

[Dave S]

So Phil,
I checked out your posting.  What did you fix to make it work?

And Eric,
<same_source_ip /> is a legit tag for a composite rule.
See http://www.ossec.net/main/manual/configuration-options/#rules_options
Table 4.1

- Dave