HP-UX Host Intrusion Detection System Version 4.1 Administrator's Guide

Figure 5-11 Edit Dialog - Edit
3. Edit the value in the text box. In general, the value cannot be null.
4. Click OK to accept the new value and Cancel to leave the value
unchanged.
c. To delete a current value
1. Highlight one of the values in the Edit List display. If you highlight more
than one, the first one is processed.
2. Click the Delete button. The value is deleted. Lists can be empty.
Undoing and Redoing Changes
You can roll back and forth for the changes you have made by using the Undo and
Redo buttons. For more information, see “Undoing and Redoing Changes” (page 76)
for details.
Suggested Best Practices
The default configurations for the templates in HP-UX HIDS may result in generation
of many alerts. You may wish to fine-tune the operation of the templates to maximize
detection of intrusions while minimizing spurious alerts (also termed “false positives”).
Use the tune command provided by idsadmin to fine-tune schedules automatically.
For information on using the tune command, see “Tuning Schedules Using the
idsadmin Command” (page 219)
It is important to realize that the throughput of HP-UX HIDS is affected by the
combination of templates activated at a given time. Some templates have more complex
heuristics and will impose a larger overhead on the system.
It may require a number of iterations to obtain a well-tuned set of templates for a given
system. HP recommends the following best practices:
• Identify the critical resources on the system that must be protected. You can use
the tune command to tune the templates to focus on these critical resources.
• Determine when the system is most vulnerable to threats. Create a surveillance
schedule to be active during the vulnerable time periods.
Configuring Detection Templates 83