Re: [ossec-list] Temporary "Mute" some events

[Js Opdebeeck]

Hi ;
 
I create some local_rules.xml
 
Just in case ... looks to solve my issue . Goal is to classify without just 
ignoring.
 

   <rule id="900039" level="2">
    <if_sid>1002</if_sid>
    <match>failed to issue command due to Not found (APD)</match>
    <description>VMWare (All Paths Dead) state </description>
   </rule>

   <rule id="900040" level="2">
    <if_sid>1003</if_sid>
    <match>VBRuntime</match>
    <description>VB Runtime Error</description>
   </rule>
 
   <rule id="900041" level="2">
    <if_sid>4151</if_sid>
    <match>service=rip</match>
    <description>Netscreen RIP service</description>
   </rule>

   <rule id="900042" level="2">
    <if_sid>4151</if_sid>
    <match>policy_id=320001 service=udp/port:1985</match>
    <description>Netscreen RIP service</description>
   </rule>