[ossec-list] Re: separate email address for agents

["Peter M. Abraham" <peter.m.abraham@xxxxxxxxx>]

Greetings Jason:

This is a very good idea.

In the mean time since the alerts do include the server host name and
IP address in the email notification, would it be possible to have the
email go to a distribution list which is then parsed to determine the
actual distribution?

I.e. if your mail server is qmail, you can have shell code or calls to
Perl within your .qmail forward files where the email is examined, and
then sent to the right department / person.

Thank you.