Hello,
On Mon, 18 Feb 2008 11:03:24 -0500
Michael Starks <[EMAIL PROTECTED]> wrote:
> > Is it possible to configure ossec don't send email alerts of some
> > level 10 rules?
> <options>no_email_alert</options>
Tnanks! I've made it in local_rules.xml:
<rule id="100003" level="10">
<if_sid>3353</if_sid>
<options>no_email_alert</options>
<description>Multiple attempts to send e-mail from </description>
<description>invalid/unknown sender domain.</description>
<group>syslog,postfix,multiple_spam,</group>
</rule>
It works.
--
DSS5-RIPE DSS-RIPN mailto:[EMAIL PROTECTED] xmpp:[EMAIL PROTECTED]
http://wizard.volgograd.ru/ 2:550/[EMAIL PROTECTED] 2:550/[EMAIL PROTECTED]
