[ossec-dev] Redirecting alerts to different recipients

[paul sery <pgsery@xxxxxxxx>]

Hey,

  I want to direct ossec alerts to the person managing the machine on 
which it occurred. I'm managing a central logging system and am feeding 
its event stream into an ossec instance. I've cobbled together a simple 
active-response script that uses the IP parameter to send the alert ID 
to the appropriate person, but also would also like to send the log 
messages that triggered the alert -- like you get in the e-mail alerts. 
Is there any way of getting that info to the active-response mechanism? 
Or perhaps I'm missing an obvious way to do the distribution.

Thanks,
Paul