Quoting Jakov Sosic <[email protected]> at Mon, 27 Feb 2012
15:29:39 +0100:
Hi
I'm using server-client setup, with activeresponse. But I would like
to whitelist some IP's only on some agents. Is that possible?
I've found a bug from 5 years ago:
http://marc.info/?l=ossec-dev&m=119742698220234
Is this possible to do, I'm using v2.6, and I'm pushing agent
configurations from server through /var/ossec/etc/shared/agent.conf.
ty
Did you try it with a seperate <agent_config name="name of client as
registered to ossec server"> tag in the agent.conf for that client and
put a whitelist in there?
S
