get_active_responses
Fetch active response configurations that automate actions like IP blocking or script execution on OSSEC alert triggers.
Instructions
Get configured active response rules.
Active responses are automated actions OSSEC can take when specific alerts trigger, such as blocking an IP, restarting a service, or running a custom script.
Returns: JSON array of active response configurations including command, location, rules_id, and timeout.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |