email - Single OSSEC rule to supress alert_by_email -


im trying supress/ignore alert_by_email-option every ossec-rule. documentation suggests following:

"some rules have option set force ossec sending alert email. option alert_by_email. 1 of these rules 1002. ignore these rules have create rule ignore it, or overwrite rule without alert_by_email option."

however not find example creating single role ignore option. hope guys can me.

add following rule in ossec/rules/local_rules.xml file:

add rule @ bottom of file make sure within <group> tag.

<group>    ...    ..    ...      <rule id="1002" level="2" overwrite="yes">       <options>no_email_alert</options>       <description>unknown problem somewhere in system.</description>     </rule>  </group> 

this stop sending email alerts rule id=1002


Comments

Popular posts from this blog

php - Admin SDK -- get information about the group -

dns - How To Use Custom Nameserver On Free Cloudflare? -

Python Error - TypeError: input expected at most 1 arguments, got 3 -