[ossec-list] Re: What is the best way to preserve the excluded rules in ossec.conf

["Peter M. Abraham" <peter.m.abraham@xxxxxxxxx>]

Greetings Daniel:

I don't mean on an individual rule basis, but in ossec.conf there are
includes for rules which are not applicable for our environment.

Such as

<include>symantec-av_rules.xml</include>

Right now I comment such rules out; but when I upgraded from 1.2 to
1.3, the upgrade process put them all back.

Is there a way I can avoid that happening to our ossec server?

Thank you.