Hi Daniel: Thank you for your response.
Since we use active-response based on sid rather than level, this might be far more work given we have around 30 agents with possibly more in the future. I did open up http://www.ossec.net/bugs/show_bug.cgi?id=141 as an enhancement request for yours and your team's review and consideration. Thank you!
