Kevin Reiter wrote:
: Hello list,
:
: I'm trying to stop sending an e-mail alert when a rule fires and
: certain criteria are matched, as per
:
http://www.ossec.net/wiki/index.php/Know_How:Ignore_Rules#Ignoring_syslog_message
:
<snip>
: <!-- Ignore Snort02 going into promisc mode -->
:
: <rule id="103004" level="0">
: <if_sid>5104</if_sid>
: <match>Snort02</match>
: <description>Interface (xl0) entered promiscuous mode on
: Snort02</description> </rule>
:
I've changed the rule to:
<!-- Ignore Snort02 going into promisc mode -->
<rule id="103004" level="0">
<if_sid>5104</if_sid>
<hostname>Snort02</hostname>
<description>Interface (xl0) entered promiscuous mode on
Snort02</description>
</rule>
..and still get the alerts..
This message may contain confidential or proprietary information and is
intended solely for the individual(s) to whom it is addressed. If you are not
a named addressee you should not disseminate, distribute or copy this e-mail or
act upon the information contained herein. Please notify the sender
immediately by e-mail if you have received this e-mail by mistake and delete
this e-mail from your system.
