Host Intrusion Detection System Administrator's Guide Release 3.0

Templates and Alerts
Template Property Types
Appendix A
131
pathnames_1 | f1 & f2
programs_1 | p1
pathnames_2 | f1 & f2
programs_2 | p2
pathnames_3 | f1 & f2
programs_3 | p3
• However, it is not equal to the following:
4.
pathnames_1 | f1
programs_1 | p1 & p2 & p3
pathnames_2 | f2
programs_2 | p1 & p3
The rationale here is to provide a finer granularity for users to specify their file
monitoring dependencies. That is, in (4) an alert for f2 will be generated if the event was
triggered by p2, as opposed to what happens when any of (1), (2) or (3) are used.
Type III: UIDs
The values for this property consists of lists of UIDs that the template is to explicitly
take into account (type IIIa) or explicitly ignore (type IIIb) when determining whether or
not an alarm is to be issued. The following template property specifies three UIDs, which
will be explicitly taken into account while generating an alert:
priv_uid_list | 22|1|43
The following template property specifies that alerts concerning the three UIDs will not
be generated:
uids_to_ignore | 21|3|53
specifies three UIDs, which will be explicitly ignored, when generating an alert,
depending on the template type.
Type IV: UID Pairs
In this case the values consist of lists of pairs of UIDs. In each pair, the two members are
separated by a comma. When an event is received for a file that is being monitored, the
following criteria are applied for every pair in the list:
• The effective UID of the process modifying this file is the same as the first member of
the pair
• The owner of the file has the same UID as the second member of the pair
If both these conditions are true, no alert is issued.
In the following command line:
uid_pairs_to_ignore | 2, 16 | 4, 3