[ossec-list] Re: SSH Brute Force Attacks and Alerting

[Ben Ruset <ben.ruset@xxxxxxxxxxx>]

Well, am I right in assuming that the config should stop all rules 
greater than level 7 from being emailed?

Is rule level 1 more servere than rule level 16?

Thanks,
-ben

Tommy May wrote:
> This was very helpful to me....(thanks to Daniel Cid)
>
> http://www.ossec.net/wiki/index.php/Know_How:Ignore_Rules
>
> This isn't just to ignore rules...this also tells you that you can ignore all rules "unless it matches a very specific pattern".
>
> Hope this is helpful.
>
> Tommy