This can be done with the simple event correlator and a configuration file along the lines of
type=SingleWithThreshold
ptype=SubStr
pattern=SOMETHING.COM
desc=SOMETHING.COM
action=pipe '%s' /usr/bin/mail -s 'SOMETHING.COM' [email protected]
window=86400
thresh=1
And sec
told to use the file containing the above against the file that the log appears in (this will vary depending on how sec
is installed, whether there's a vendor package, etc).
The window
is rather important unless you like dealing with hundreds or thousands of email messages for each and every log line matched; sec
has other means of rolling up or summarizing results; see the documentation.