HP-UX Host Intrusion Detection System Version 4.3 administrator guide

File Being Modified
Table A-10 lists the alert properties this template generates and forwards to a response program
when a file is modified.
Table A-10 File Being Modified Alert Properties
DescriptionAlert Value/FormatAlert Field
Type
Alert FieldResponse
Program
Argument
Unique code assigned to
template
2IntegerTemplate codeargv[1]
Template version<version>IntegerVersionargv[2]
Alert severity2 if file is truncated, potentially
truncated, deleted, or renamed.3 if file’s
mode or ownership is modified, if file
is created, or if file is opened for writing
or appending.
IntegerSeverityargv[3]
UTC time in number of
seconds since the epoch
when file was modified
<secs>IntegerUTC timeargv[4]
The user ID, group ID,
process ID, and parent
process ID of the process
that modified the file
uid=<uid>, gid=<gid>, pid=<pid>,
ppid=<ppid>
StringAttackerargv[5]
The full path name of the
file that was modified
and the file’s type, mode,
uid, gid, inode, and
device number
file=<full pathname>, type=<type>,
mode=<mode>, uid=<uid>, gid=<gid>,
inode=<inode>, device=<device>
StringTarget of
attack
argv[6]
Alert summaryFile system modification or potential
modification.
StringSummaryargv[7]
Detailed alert descriptionUser with uid<uid> <performed action
on the file> <full pathname>
(type=<type>, inode=<inode>,
device=<device>) when executing
<program> (type=<type>,
inode=<inode>, device=<device>),
invoked as follows:
<argv[0]><argv[1]>..., as process with
pid <pid> and ppid <ppid> and running
with effective uid=<euid> and with
effective gid=<egid>.where <performed
action on the file> is set to one of the
following:
• changed the owner of
• changed the permission of
• opened for modification/truncation
• renamed the file
• created the file (and overwrote any
existing file) named
• truncated the file
• created as a hard link
• created as a symbolic link
StringDetailsargv[8]
Modification of files/directories Template 131