|Alert Message||OSSEC event|
This is an internal OSSEC anomaly detection event. It detects when the average number of log events on the system is spiking anomalously
 What you should do
This means that the average log volume for the host has spiked for some reason. It could indicate an attack, or just a spike in log traffic volume related to utilization. Investigate the nature of the spike
 False Positives
There are no false positives with this rule.
 Tuning Guidance
There is no guidance for tuning this rule.
 Additional Information
If you are unsure about how to respond to this alert, please contact Atomicorp support. We're here to help you!
 Similar Rules
 Knowledge Base Articles
 Outside References