Report limit on specific servers

[JP H]

Hello,

Is there a way to limit reports to specific servers?  In other words, I don't want to report on failed logins for every server, just 3 or 4 in a daily summarized email.

I don't really see a way to do it via <reports></reports> in ossec.conf or ossec-remoted.

Thanks,

j

[Alejandro Ruiz Gonzalez]

Hello,

Thanks for using Wazuh!

In case you want to limit the report you may take a look to this documentation about the report:

https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/reports.html?highlight=report

Let me know if that information was useful to you.

[JP H]

Thank you, I was able to figure out what I needed based on the information in that link.

J