Hi, just adjust the level of this rule so it is equal or over your active reponse threshold (by default level 6) and under your email_alert_level threshold (default level 7). Bot his specified in your ossec.conf
Regards Christian Am 17.03.2013 11:17, schrieb Jan Kopecký: > Hello, > > I would like immediately block bad search bots with auto-response but > I don't want get mail alerts because of lot of accesses. > > I created this rule: > > <rule id="100061" level="14"> > <if_sid>31100</if_sid> > <match>MJ12bot</match> > <description>Majestic bot access</description> > </rule> > > and it seems works but it send mail alert with every access so I get > hundreds mails per day. Is there possibility to block with > auto-response and avoid mail alert or is there some better way to > block bad bots? > -- > > --- > You received this message because you are subscribed to the Google > Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send > an email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
