On Wed, Dec 23, 2015 at 8:39 AM, Maxim Surdu <[email protected]> wrote: > Hi everyone, > > I am new in Ossec, i installed Virtual Appliance of ossec, all is working > fine, can i do to ossec mail me for specific rule? > for example for this rule > > > <group name="policy_violation,"> > <rule id="17101" level="9"> > <if_group>authentication_success</if_group> > <time>06:00 pm - 09:00 am</time> > <description>Successful login during non-business hours.</description> > <group>login_time,</group> > </rule> > > > > Any help would be greatly appreciated >
Do you want those emails to go to a specific email address different from the normal address? If your settings allow alert level 9 emails, this should be sent already. > Thanks, > Maxim > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
