Active response doesn't work

[hello1afk]

I am setting up some rules to test the ossec server attacked by flood syn from kali linux.
I have configure some rules in ossec.conf to help it defense when being attacked:

host-deny local 6 600 firewall-drop local 6 600 no firewall-drop local 5710 1800

The active response litterally doesn't work, it doesn't alert sshd authentication fail or anything, and the server is litterally being attacked without any alert to me.
Any solutions to this problem? Appreciate for your replies.

[hello1afk]

https://documentation.wazuh.com/current/compliance/pci-dss/active-response.html

I use block of code in this link to conf (The github doesn't allow me to paste code )

[libellux]

Hello, could you share your active-response section from your configuration file? Here's an example that I use without any issues. Also make sure that the machine you're testing from isn't included within the <allow_list> as it would not be affected by the active response https://ossec-documentation.readthedocs.io/en/latest/configuration/ossec_conf.html#allow-list

  <!-- Active Response Config -->
  <active-response>
    <!-- This response is going to execute the host-deny
       - command for every event that fires a rule with
       - level (severity) >= 6.
       - The IP is going to be blocked for  600 seconds.
      -->
    <command>host-deny</command>
    <location>all</location>
    <level>6</level>
    <timeout>600</timeout>
    <repeated_offenders>30,60,120,240,480</repeated_offenders>
  </active-response>

  <active-response>
    <!-- Firewall Drop response. Block the IP for
       - 600 seconds on the firewall (iptables,
       - ipfilter, etc).
      -->
    <command>firewall-drop</command>
    <location>all</location>
    <level>6</level>
    <timeout>600</timeout>
    <repeated_offenders>30,60,120,240,480</repeated_offenders>
  </active-response>

  <active-response>
    <command>ossec-slack</command>
    <location>server</location>
    <level>6</level>
  </active-response>

  <active-response>
    <command>cloudflare-ban</command>
    <location>server</location>
    <level>6</level>
    <timeout>43200</timeout>
  </active-response>