subject:"\[ossec\-list\] Re\: Custom rules \-\- how do you do an if multiple sid\?"

[ossec-list] Re: Custom rules -- how do you do an if multiple sid?

2007-11-20 Thread Peter M. Abraham

Greetings Daniel: Thank you.

[ossec-list] Re: Custom rules -- how do you do an if multiple sid?

2007-11-19 Thread Daniel Cid

Hi Peter, The right syntax is to use commas between the rules ids: if_sid4801,4803, 4806/if_sid You can also assign groups to your rules and use if_group to match on them ... Hope it helps. -- Daniel B. Cid dcid ( at ) ossec.net On Nov 17, 2007 12:31 PM, Peter M. Abraham [EMAIL