HP-UX Host Intrusion Detection System Version 4.3 administrator guide

Table B-1 Additional Arguments Passed to Response Programs for Kernel Template Alerts
(continued)
DescriptionAlert Value/FormatAlert Field TypeAlert FieldResponse
Program
Argument
Mode of the attack program<mode> (decimal)IntegerAttack Program
Mode
argv[26]
Owner of the attack program (uid)<uid>IntegerAttack Program
Owner
argv[27]
Group of the attack program (gid)<gid>IntegerAttack Program
Group
argv[28]
Inode number of the attack program<inode>IntegerAttack Program
Inode
argv[29]
Device number of the attack program<device>IntegerAttack Program
Device
argv[30]
Number of arguments passed to the
attack program (for example, argc)
<argc>IntegerAttack Program
Argument
Count
argv[31]
Program arguments of the attack
program (first 1024 characters)
<argv[0]> <argv[1]>
...
StringAttack Program
Arguments
argv[32]
Name of the pty on which the
attacker is connected to (for example,
pts/ta). Set to an empty string if it is
not known.
<pty>StringAttacker
pseudo-tty
argv[33]
Full host name of remote host from
which the attacker has logged in. Set
to localhost name or to an empty
string if the local host is not known.
<hostname>StringAttacker
hostname
argv[34]
IP address (in Ipv4 or IPv6 string
notation) of the remote host from
which the attacker logged in. Set to
an empty string if the address is not
known.
<A.B.C.D> (IPv4)
or <X:X:X:....>
(IPv6)
StringAttacker IP
address
argv[35]
Table B-2 lists the additional arguments that are passed to response programs for suppressed
alerts.
Table B-2 Additional Arguments Passed to Response Programs for Suppressed Alerts
DescriptionAlert Value/ FormatAlert Field TypeAlert Field
Response Program
Argument
Number of duplicate
alerts that were
suppressed.
<number of
suppressed
alerts>
IntegerNumber of
suppressed alerts
argv[36]
Time elapsed when
duplicate alerts were
suppressed
<time unit>
IntegerUnit of time (can be
seconds, minutes,
hours, or days). The
default is seconds.
argv[37]
Table B-3 lists the additional arguments that are passed to response programs while
attempting the modification of files that belong to Modification of files/
directories template, Changes to Log File template, and Modification of
Another User’s File template.
162 Automated Response for Alerts