Just learning OSSEC here using the documentation on ossec.net to
troubleshoot some problems.I am receiving excessive HIDS notifications
in a log for a windows machines(an agent) in my OSSEC environment.
When looking at the security log, it seems that too many events are
being added to the queue, mostly system activity, in the security log
of the windows machine. Which files should I look to, to start
adjusting configurations for what I want to ignore and what I would
like to include in the alerts.log file? I looked at ossec.conf and now
I just don't see a file where I can modify alerts going into the
alerts.log file. Thank you.
