From ossec.conf:

  <global>
    <email_notification>yes</email_notification>
    <email_to>foo@maverick.org</email_to>
    <smtp_server>mail.moosenugget.org</smtp_server>
    <email_from>ossec@moosenugget.org</email_from>
  </global>


  <email_alerts>
    <email_to>foo@erols.com</email_to>
    <rule_id>100100</rule_id>
  </email_alerts>



From local_rules.xml

<group name="syslog,postfix,">
  <rule id="100100" level="12">
    <if_sid>3300</if_sid>
    <id>450$</id>
    <description>LOCAL: Sender domain is not found </description>
    <description>(450: Requested mail action not taken).</description>
    <group>spam,</group>
  </rule>
</group>