I'm a bit fuzzed on the relationship between the server and agents with respect to rule processing. I have an OSSEC server with several agents connected. If I want to make a change to a rule that affects a given host, do I make the change on the server or the host(s)?