HP-UX Host Intrusion Detection System Version 4.3 administrator guide

monitors a user-specified set of regular files for successful attempts to open a file with write or
truncate permission, to delete the file, to rename the file, or to truncate the file.
This template does not monitor changes in file ownership or permissions. The template also does
not monitor for the creation of a new file. Finally, this template does not determine that a file’s
contents were changed, only that a change might have been made. It does not watch the content
of the files, only that a file was opened with permission other than append. Instead of monitoring
write(2) calls that modify files, successful opens to write to the file to provide early detection of
processes that might potentially modify critical files by some means other than appending.
How this template is configured
Table A-11 lists the configurable properties this template supports.
Table A-12 Template Properties
Default ValueTypeName
^/var/adm/btmp$ | ^/var/adm/wtmp$ |
^/var/adm/messages$ | ^/var/adm/syslog/mail log $ |
^/var/adm/syslog/sysloġlog$ | ^/var/adm/pacct$ |
^/var/adm/sulog$
I
pathnames_to_watch
<empty>I
pathnames_to_not_watch
<empty>II
pathnames_X
<empty>II
programs_X
Properties
A brief description about the configurable properties are listed below:
pathnames_to_watch
Path names of files to be monitored for modification other
than appending.
pathnames_to_not_watch
Path names of files that can be safely ignored for
modification, regardless of which program modifies them.
pathnames_X, programs_X
Use these properties to filter out alerts generated when a
particular program modifies a particular file other than
appending. See “Type II: Path Names/Programs Pairs”
(page 116) for a detailed description of these property pairs.
Alerts generated by this template
Append-Only File Being Modified
Table A-13 lists the alert properties this template generates and forwards to a response program
when a file is modified in a way other than being appended to.
Table A-13 Append-Only File Being Modified Alert Properties
DescriptionAlert Value/FormatAlert Field TypeAlert FieldResponse
Program
Argument
Unique code assigned to
template
3IntegerTemplate codeargv[1]
Template version<version>IntegerVersionargv[2]
Alert Severity2IntegerSeverityargv[3]
UTC time in number of
seconds since the epoch
when file was modified
<secs>IntegerUTC timeargv[4]
Changes to Log File Template 135