There isn't really a good way. You could build the logic into the AR scripts on the agent, or turn off AR on the agent I guess.
On Thu, Dec 8, 2011 at 9:54 AM, Florian Roscher <[email protected]> wrote: > Hello! > > > I do want to define several active responses, which should > be executed on the agent who generated the alert which > triggered that event ( using <location>local</location> ). > > Is there a way to exclude special hosts/agents from that > active-response-definition? > Or to exclude an agent, i.e. the ossec server from all > active responses? > > > Any help apreciated, thanks > Florian Roscher > > > -- > Florian Roscher private: [email protected] > Debian: [email protected] > PGP Key / ID: 1024D/B4071A65 > Fingerprint : F9AB 00C1 3E3A 8125 DD3F DF1C DF79 A374 B407 1A65
