I hope you don't mean rule 1002 or any of the other ~22 rules that have the <alert_by_email> option set. It'd be disheartening to have to explain this again this week.
On Wed, May 9, 2012 at 2:19 PM, [email protected] <[email protected]> wrote: > I must be missing something - I have my alerting threshold set to "8" > in the ossec-server.conf file, but continue to receive email > notifications (alerts?) for a number of events which have been defined > as 7 and below. Ossec-hids suite was restarted after mods were made - > where am I running off the track?
