OSSEC 3.0.0 alerts include alert type in subject line

[zenmonkeykstop]

Description

In OSSEC 2.8.2 as configured for SD, email alert subject lines follow the format OSSEC Notification - <hostname> - Alert level <#>

In OSSEC 3.0.0, subject lines follow the format OSSEC Notification - <hostname> - Alert level <#> - <alert type>, where is the description text for the first triggered rule listed in the email.

Because the subject line is unencrypted, and OSSEC alerts are typically sent via 3rd-party email services, this could provide an adversary with some information as to the behaviour of SD servers and their response to attacks.

Steps to Reproduce

Install 0.10.0-rc2 SecureDrop with OSSEC set to deliver email alerts, and read the alerts.

Expected Behavior

OSSEC alert email behaviour unchanged.

Actual Behavior

OSSEC alert email subject lines changed to include more information than previously.

Comments

Suggestions to fix, any other relevant information.