Check out the docs here http://www.ossec.net/main/manual/manual-active-responses for basic information on setting up AR.
Once you configure for it, you'll need to shutdown the server and restart it, but that's all the disruption that should be needed.
