Rules options are available in the the following installation types:
All global options must be configured in the /var/ossec/etc/ossec.conf and used within the <ossec_config> tag.
XML excerpt to show location:
<ossec_config> <rules> <!-- Rules options here --> </rules> </ossec_config>
ossec.conf: Rootcheck options
ossec.conf: Syscheck Options
Enter search terms or a module, class or function name.