I don't have the <level> tag in my config and it seems to work ok.
-----------------------------
ossec.conf:
-----------------------------
<!-- Active Response Config -->
<active-response>
<!-- This response is going to execute the host-deny
- command for every matching rule.
- The IP is going to be blocked for 600 seconds.
-->
<command>host-deny</command>
<location>local</location>
<rules_id>5551,5706,5712,5720,11210,30107,31103,31104,100005,11251,30114,31153,5706</
rules_id>
<timeout>3600</timeout>
</active-response>
-----------------------------
example alert email:
-----------------------------
OSSEC HIDS Notification.
2009 May 13 12:45:28
Received From: plesk2->/var/log/secure
Rule: 11210 fired (level 10) -> "Multiple failed login attempts."
Portion of the log(s):
May 13 12:45:26 plesk2 proftpd[19238]: plesk2.netspace.net.au
(124.118.247.4[124.118.247.4]) - Maximum login attempts (3) exceeded
-----------------------------
active-responses.log
-----------------------------
Wed May 13 12:45:28 EST 2009 /usr/local/ossec/active-response/bin/host-
deny.sh add - 124.118.247.4 1242182728.832155 11210
Hope that helps. Try removing the <level> tag.
Explained a little bit in this FAQ.
http://www.ossec.net/wiki/index.php/Know_How:CustomActiveResponses
Cheers.
Andy
