I am the OSSEC FreeBSD port maintainer.
For a long time there is a bug in "active-response/host-deny.sh" where OSSEC installation directory is hardcoded to "/var/ossec". I have replaced it with "${PWD}" as seen in other active response scripts. Note however, that this will default to "/var/ossec/active-response" instead.
See attached patch.
patch-active-response_host-deny.sh.txt