[ossec-list] Re: want to add a rule for an alert

[upen]

On Feb 8, 7:35 pm, "dan (ddp)" <ddp...@gmail.com> wrote:
> What do you have so far?

Thanks for quick reply.

  <!-- Specify here a list of rules to ignore. -->
  <!--
  <rule id="100040" level="2">
    <if_sid>1002</if_sid>
<match>servername kernel: graph</match>
    <description>servername kernel: graph</description>
  </rule>
  -->

  <!-- Specify here a list of rules to ignore. -->
  <!--
  <rule id="100050" level="2">
    <if_sid>1002</if_sid>
<match>general protection</match>
    <description>protection</description>
  </rule>
  -->