This seems to fix a crash I was seeing.
Trying to reproduce for the logs.
Merge branch 'ossecalert_decoder_crash'
Removing English install message to email Daniel Cid. I'll leave the other languages to someone else.
Fixing hard-coded paths
Merge branch 'master' of github.com:ossec/ossec-hids
Merge branch 'master' of github.com:ossec/ossec-hids
Updated help.txt for Windows

Updated help.txt for Windows which had some old content as reported by
mstarks in #225.

Removed stale link to documentation.

Removed the commercial support
section since it doesn't appear that TrendMicro has any interest in it
anymore.

Removed dcid's blog. Doesn't look like his new blog has any new
content and for any intereseted parties there is a link on the OSSEC
website.

Removed version number from body of the file since it is already
displayed at the top of the file correctly.
Merge pull request #229 from awiddersheim/fix_windows_help

Updated help.txt for Windows
Lines sent to SMTP server need to be terminated with \r\n, not \n.

Lines sent to SMTP server need \r\n, not just \n
fix crash in is_simple_http_request

Under some conditions is_simple_http_request access lf->url unchecked. If lf->url is null, it will segfault.
Merge branch 'master' of github.com:ossec/ossec-hids
Merge pull request #232 from navtej/master

fix crash in is_simple_http_request

Under some conditions is_simple_http_request access lf->url unchecked. If lf->url is null, it will segfault.
fix crash in is_simple_http_request

Under some conditions is_simple_http_request access lf->url unchecked. If lf->url is null, it will segfault.
Ensure free(*dst) doesn't dereference a null pointer.
Merge pull request #233 from reyjrar/fix/accumulator-null-check

Fix/accumulator null check
Add a VERY basic deoccder for apparmor, and a couple of rules to
basically ignore things.
The IDs for the rules are in the user range, but that can change later.
Sample log message is from RealRancor on github #234. Hopefully he
can help expand the rules.
Update copyright date
Update the decoder to add the operation. This seems important for
determining how malicious some action is.
Add arule to alert on DENIED messages.

The examples provided by @RealRancor illustrate an issue. The
original examples that were provided were in a syslog format
with "kernel" as the program_name. This made them identify as
iptables log messages. The DENIED examples did not have the syslog
header, and identified as auditd log messages. This work should
probably duplicate what was already done for auditd.
Add a couple of rules for breaking down the operations in the
DENIED log samples. I don't know how much value something like this
really has, but I don't have a lot of experience with apparmor.

On another note, but British may be right. Armour feels more right
than armor.
fix comment in decoder.xml