I think, by default, OSSEC has the active-response for blocking an IP if an alert higher than 6 is fired. I recommend to disable this setting.
Regards. On Tuesday, July 11, 2017 at 8:37:21 PM UTC+2, Cristian Lorenzetto wrote: > > is there a condition where ossec blocks all incoming connections? > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
