I think the most common way I've seen something like this done is by using multiple OSSEC managers.
On Thu, Oct 28, 2010 at 10:06 AM, ItsMikeE <[email protected]> wrote: > As I add more agents to ossec, I am beginning to see a need for > classifying agents into groups. > > For example, it is more important to know about an alert to a live > server than a development server. > Similarly some applications are more high-profile than others. > > Is there a way to highlight that an alert is from one of a particular > groups of servers (perhaps with a GUI, or perhaps in the 'subject' in > emails)?
