Trevor, I've seen this behavior too and have posted about it to no avail. See http://groups.google.com/group/ossec-list/browse_thread/thread/e0dfa4813f0d6f85/691e61482da421dd
I don't know if this is a bug or a case where the software developer and technical writers were out of synch, but since the <disabled> tag goes within the individual <active-response> sections, I would think it's a bug. - Dave
