HP-UX Host Intrusion Detection System Version 4.1 Administrator's Guide

NOTE: The /etc/opt/ids/schedules/sample/groups directory contains
read-only copies of the predefined surveillance groups. Users who want to revert back
to the original predefined surveillance groups can manually copy them from
/etc/opt/ids/schedules/sample/groups into /etc/opt/schedules/groups.
Creating a New Surveillance Group
To create a new surveillance group, follow the steps:
1. On the Schedule Manager screen select the Configure tab.
2. Create a new name for the new surveillance group using the following steps:
a. Click the New button on the Surveillance Groups panel. This opens the New
Surveillance Group dialog box (Figure 5-5).
Figure 5-5 New Surveillance Group Dialog
b. Enter a name in the input field. Valid characters are alphanumeric and
underscore; the first character must be alphanumeric. Surveillance group
names are case-sensitive. If you include invalid characters, you will be
prompted to have them replaced with underscores.
c. Click OK to accept and Cancel to exit the dialog box.
A new group is initialized with no templates selected. All template properties have
their default values.
3. To set up the new group, use the steps in “Modifying a Surveillance Group”
(page 78).
Copying a Surveillance Group
If an existing surveillance group is similar to what you want, you can copy the group
and rename it, or directly edit the existing group. For example, if you wanted a group
to run from 9 a.m. to 5 p.m. Monday through Friday . On Saturday and Sunday the
group must run for 24 hours. To set this schedule for Saturday and Sunday copy the
Monday-Friday group and set a different timetable in the Saturday-Sunday group.
To copy a surveillance group, follow the steps:
1. On the Schedule Manager screen select the Configure tab.
Configuring Surveillance Groups 77