HP-UX Host Intrusion Detection System Version 4.1 Administrator's Guide

0 no alerts are generated for hosts in the specified network
Type VI: Time Strings
The time strings property represents time intervals. Each time string has the following
syntax:
integer[units]
The integer component is a positive integer representing a time interval. The units
component, when present, indicates the time units the integer is expressed in. The
following units are supported:
s
Seconds
m
Minutes
h
Hours
d
Days
w
Weeks
When the unit component is not present, the integer component is assumed to be in
seconds. For example, the following lines in the template configuration file contain
time strings representing values of 23 seconds, 10 minutes, 1 hour and 23 seconds; the
s component in the last line is redundant, but can be used for clarity.
fail_interval | 23warning_interval | 10mfail_interval |
1hwarning_interval | 23s
NOTE: You cannot specify the time unit value in the Schedule Manager screen.
Type VII: Flags
The Type VII property value is an integer used to enable or disable a flag. A value of
1 means enabled, and a value of 0 means disabled. For example, the following properties
of the Login/Logout template specify that the monitoring of logins is enabled, and the
monitoring of successful su commands is disabled:
monitor_login_flag | 1
monitor_su_flag | 0
Type VIII: Scalars
The Type VIII property value is a single integer. However, this value can be any integer.
For example, the following property of the Buffer Overflow template specifies that 500
is considered an unusually long argument length when invoking a priviledged setuid
program:
unusual_arg_len | 500
Type IX: Path Names / Integer Pairs
The Type IX property specifies pairs of path names and integers. In each pair, the two
members are separated by a comma and pairs are separated by a pipe. The path name
is interpreted as regular expressions and extended regular expressions. For more
Template Property Types 145