[ossec-list] Re: False positive

[DrBob <drbob@xxxxxxxxxxxx>]

Already found some examples on the wiki (but rather hard to find I
admit).
I created this rule

<group name="local">
 <rule id="100101" level="0">
   <if_sid>31106</if_sid>
   <match>splunk</match>
   <user>drbob</user>
   <description>Events ignored</description>
 </rule>
</group>

This should work for me as it ignores the main rule when I use splunk
(which is proxied by apache from port 8000 to port 80) when I logon.
When someone else tries to logon it should still fire and trigger an
active response.