I have OSSEC HIDS (2.8.3) installed (I have it set up as a local installation) and setup so that it sends me email alerts for the various alert levels. The only problem is with level 2 alerts which are normally nothing of importance and just spam my inbox.

So I was wondering if there is any way of stopping it from sending me level 2 alerts so that it sends me all the others but just not those? (I am looking for something which I can configure in the OSSEC HIDS settings, I don't want a sort of just external hack which filters the emails it sends me or something because that could run the risk of it filtering out other alert levels too.)

1 Answer

For say if you want to get only alerts greater than 8 you can filter that by adding the below snippet in your server's ossec.conf file,

-email_alerts-
-level-8-/level-
-/email_alerts-

Not sure why couldn't use <> symbols use <> instead of - for opening and closing brackets This will help to trigger alerts levels of 8 and 8+.

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password Submit

Post as a guest

Post Your Answer Discard

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy