[ossec-list] Quick Active Response Question

[Kurt <sifukurt@xxxxxxxxx>]

I wanted to know if someone could provide me with a little bit of clarification. I think I know the answer but I want to confirm this before I potentially head off in the wrong direction. When configuring active response, when specifiying the "location," does the "all" option apply to the analysis server and *all* of the sensors? Or just the analysis server and the sensor in question?

Thanks in advance.
 
Kurt
perl -e "($_='tjgvlvsuAzbipp/dpn')=~s/(.)/chr(ord($1)-1)/ge;print"

My Blog: http://kwoon.blogspot.com
PGP Public Key (0x71D25CDA) @ http://cryptonomicon.mit.edu/
-----
Inveniemus viam aut faciemus --Hannibal




 
____________________________________________________________________________________
Expecting? Get great news right away with email Auto-Check. 
Try the Yahoo! Mail Beta.
http://advision.webevents.yahoo.com/mailbeta/newmail_tools.html