[ossec-list] Port 25 alerts?

[rudykaz]

What do I need to do, what rule applies, to send an ossec email alert if a 
machine on my network is suddenly using port 25 when it shouldn't be?

Thanks
 

Sent from my Verizon Wireless BlackBerry