Host Intrusion Detection System Administrator's Guide Release 3.1

Templates and Alerts
Modification of Another User’s File Template
Appendix A
169
argv[3] Severity Integer 2 if the file is truncated, potentially
truncated, deleted, or renamed.
3 if the file’s mode or ownership is
modified, or the file is opened for
writing or appending.
Alert Severity
argv[4] UTC Time Integer <secs> UTC time in
number of seconds
since epoch when
a file was modified
by a non-owner
argv[5] Attacker String uid=<uid>, gid=<gid>,
pid=<pid>, ppid=<ppid>.
The user ID, group
ID, process ID,
and parent
process ID of the
process that
modified the file
argv[6] Target of
Attack
String file=<full pathname>,
type=<type>,mode=<mode>,uid=<u
id>,gid=<gid>,inode=<inode>,de
vice=<device>.
The full pathname
of the file and the
file’s type, mode,
uid, gid,
inode, and device
number
argv[7] Summary String Non-owned file being modified. Alert summary
Table A-18 Non-Owned File Being Modified Alert Properties (Continued)
Response
Program
Argument
Alert
Field
Alert
Field Type
Alert Value/Format Description