HP-UX Host Intrusion Detection System Version 4.3 administrator guide

B Automated Response for Alerts
This appendix describes how to use response programs to process alerts automatically according
to your installation policy. It includes a sample C program, several sample response scripts, and
information about a prepackaged response program that communicates with HP OpenView
VantagePoint Operations. This appendix addresses the following topics:
• “How Automated Response Works in HP-UX HIDS” (page 160)
• “Programming Guidelines” (page 166)
• “Sample Response Programs” (page 171)
• “HP OpenView Operations SMART Plug-In” (page 177)
Response programs enable you to capture alerts automatically as they are generated by the
HP-UX HIDS agent, and to use your own tools to process them and make decisions, such as
alerting a system administrator about a potential intrusion. Response programs work in addition
to the normal agent-administration interface of HP-UX HIDS, in which alerts are reported to the
System Manager process on the administration system.
The response programs are executed on the agent system that generates the alert, thus enabling
near real-time intrusion response in the face of potential misuse.
Consider the following guidelines when responding to an intrusion attempt on a system:
• Do not do anything that is illegal in your region of the world.
Consult your local legal counsel before devising response strategies.
• Balance the response against the threat.
Not every target of an attack justifies an equal response; configure responses in proportion
to threats.
• Determine whether attack isolation is more important than continuous availability.
In response to an attack, you can disable networking on a server to isolate it from further
attacks. This isolation also serves to preserve any evidence of an intrusion. However, by
isolating the server, you can interfere with legitimate business activities.
Response Methods
Responses to intrusions use one of the following methods.
• Forwarding Information
Information about the alert can be forwarded by sending an email or calling a pager. Filtering
is required to prevent repeated alerts from causing a storm of pages. For examples, see
“Forwarding Information” (page 172).
• Halting Further Attacks
Automated response can halt further attacks by changing an attribute of the system. For
example, disabling an account, disabling remote logins, or changing a directory's access
permissions. For examples, see “Halting Further Attacks” (page 173).
• Preservation of Evidence
If evidence is to be preserved and analyzed, a response script can halt all further processing
on the system. Alternatively, it can disable network connections so that the system is
preserved in a running state. For examples, see “Preserving Evidence” (page 175).
• System Restoration to a Stable State
If business continuity is important, the system must be restored to a stable state. If critical
files are modified, they can be restored from trusted read-only media. For examples, see
“System Restoration to a Stable state” (page 177).
Response Methods 159