Host Intrusion Detection System Administrator's Guide Release 3.0

Templates and Alerts

Limitations

Appendix A

128

Limitations

This section describes the general limitations of all the templates. Template speciﬁc

limitations are included in the respective template sections:

• None of the templates perform alert aggregation or ﬁlter out identical alerts that

repeat over a given time period.

• None of the kernel ﬁle monitoring templates can ﬁlter alerts based on whether a ﬁle

is local or remote (NFS).

• Kernel ﬁle monitoring templates, by design, do not detect that the contents of a ﬁle

were modiﬁed.

• Templates do not ﬁlter alerts for ﬁles speciﬁed with relative pathnames. Files must

be speciﬁed with resolved, full pathnames.

• A template that has the pathnames_to_watch property does not monitor changes to

a ﬁle via a hard link unless the full pathname of the hard link itself is speciﬁed in

the property. Likewise, for the pathnames_to_not_watch property, modiﬁcations to

a ﬁle via a hard link are not ignored unless the full pathname of the hard link is

speciﬁed in the property.

• Kernel ﬁle monitoring templates do not monitor changes to ﬁles via symbolic links.

Therefore, full pathnames of symbolic links should be not be speciﬁed in the

pathnames_to_watch and pathnames_to_not_watch properties unless the

modiﬁcation of the symbolic link itself should [not] be monitored.

• Alerts that specify an UNKNOWN program will occur under the following

conditions:

— The program is started before the HIDS surveillance schedule is started.

— The offending process terminates right after it has performed some action to

cause an alert.

— HIDS generates the alert after the offending process has already been

terminated.