Perfect, thanks. Should have found it my self.
On Friday, May 11, 2012 1:31:41 PM UTC+3, dan (ddpbsd) wrote: > > Ignore? > http://devio.us/~ddp/ossec/docs/syntax/head_rules.html > On May 11, 2012 6:27 AM, "ignasr" <[email protected]> wrote: > >> Hello, >> >> is there a way/hack to ignore a rule for some time after it has fired? >> Ex: rule A fired and is ignored for 10mins. >> I don't use alert grouping, because different administrators would see >> events in emails from servers they are not responsible for. >> >> Thank you, >> Ignasr >> >
