Have you looked at the granular email options? http://www.ossec.net/wiki/Know_How:GranularEmail Specifically: To e-mail [email protected] for every event with severity higher than 12, from agent qwert or agt1, without any delay (immediately):
On Wed, Mar 10, 2010 at 5:35 PM, Devendra Agrawal <[email protected]> wrote: > Is it possible to specify different email addresses (for alerts) for > different hosts? For eg. I would like to let alerts go to a email addresses > for a group of hosts, but to go to other email address for another group of > hosts. > > Thanks.
