[ossec-list] Re: Active-response doesn't seem to work for some rules (ipop3 specifically but some ssh and other auth failures as well)

[Jon Bayless]

Well with that custom decoder it matches the decoder now. I will try it and see 
if it actually catches and blocks the source IPs now. 

Is there any way to test whether it is decoding that source IP and will be able 
to use it properly?

Thanks for all your help.