Hey, I didnt find anything in the manual and made a clean server install where there is no option to choose to get emails about triggered active responses. Of course I have normal email notifications configured, and if you put the level you want to receive them on to the same as the one for the execution of active responses, of course you get an email when the AR is triggered, but not about the AR but the alert level and rule. Moreover you get more emails than active respones are triggered since some of the alerts on a level higher than the minimum level for AR don't return information requested by the AR, e.g. source ip for a host.deny AR.
I want explicit email notification whenever an AR is triggered including which one and on which host. Of course the rule that triggered the AR would be nice to be included in that notification but if that can't be done, that's ok. That feature would be very nice because with granular email notifications I could make OSSEC tell a certain administrator only about triggered ARs. Anyone else has an idea? On Dec 11, 2:28 pm, "Peter M. Abraham" <[email protected]> wrote: > Greetings: > > RE: http://www.ossec.net/main/manual/ > > One of the set up options is to receive such notifications. > > Thank you.
