Hey guys, Can I have an active response only activated for a specific agent? (active reponse's location is on ossec server)
Example: I have agent1 and agent2, I have 2 active responses AR1 and AR2. I want AR1 to be triggered only by agent1 events and AR2 to be triggered only by agent2 events. Is this possible? Example config: <active-response> <command>commandname1</command> <location>server</location> // some config here? specifying agent1 <level>3</level> <active-response> <active-response> <command>commandname2</command> <location>server</location> // some config here? specifying agent2 <level>3</level> <active-response> Thanks! have a nice day! -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/ossec-list/2a4319d3-dc11-4cd8-913c-e7d3fba3ece5%40googlegroups.com.
