I can't seem to find in the documentation anywhere about the ability to email when Active Response executes a block on IP or when it would drop it. I know you can see the block message in the Active Response log, so is there a way to email those messages as well? Maybe I'm missing something or someone out there has already done this. I can't imagine I'm the first to ask about it, yet I can't seem to find anything on it anywhere. Anyone doing this? Thanks!
- [ossec-list] Email alert about Active Response changes James Ford
