Hi all, I have the following directive in my ossec.conf:
<email_alerts>
<email_to>[email protected]</email_to>
<rule_id>300042</rule_id>
<do_not_delay />
<do_not_group />
</email_alerts>
This, I would assume, should only send the email of the 300042
triggered event. Correct?
If so, it appears to not be working properly because I am receiving
emails where multiple other events are grouped into the email.
Is there anything else I can try?
TIA
