Question about OSSEC alerts

[Troy McClure]

Since implementing clapf for clamav scans of email using postfix, the email notification I get from OSSEC is filled with items that include the word attack. So, if a email comes in with heart attack (for example) in the subject, that is in the email notifications I get since clapf lists the subject in the log file. I found the file causing this to happen (/var/ossec/etc/rules.d/40_asl_syslog_rules.xml), but am not sure what to do to fix it. Is there a way to ignore lines with heart attack, etc. in the line and keep the ones with just attack in them? Also, I read in another post that if I change this file, it will probably get overwritten. What would be the suggested way to fix this?

[scott]

Send us the false positive report from that. I'd love to see it

[Troy McClure]

OK, I just sent one.