HP-UX Host Intrusion Detection System Version 4.1 Administrator's Guide

Halting Further Attacks
The response script program can stop subsequent attacks on a system either by disabling
a user’s account or by disabling the remote network connection.
Disabling a user's account
If a particular user account is generating many alerts, it may be necessary to disable
further logins on that account. The following script shows how to achieve that.
Sample Response Programs 211