Greetings Michael: RE: http://www.ossec.net/wiki/Know_How:GranularEmail <-- read please
"Where would I put this rule?" In /var/ossec/etc/ossec.conf and then restart ossec. NOTES: 1. I'm responding in the group rather than personal email as the back and forth helps all members of the group. Your questions are good, and I and others who try to help may benefit others in the process. 2. As far as I know the granular email rules *** is not *** like a rule you put in /var/ossec/rules/local_rules.xml; it is in the format I provided or per the manual (which may be an expanded or shortened version of the format). For example purposes, say you create a rule with an id of 500000 for detecting just integrity changes to just one file. Then based on http://www.ossec.net/wiki/Know_How:GranularEmail example "To e-mail [email protected] for every event from rule 123 or rule 124 (without grouping):" <email_alerts> <email_to>[email protected]</email_to> <rule_id>500000</rule_id> <do_not_delay /> <do_not_group /> </email_alerts> Thank you.
