HP-UX Host Intrusion Detection System Version 4.3 administrator guide

Table B-8 Additional Arguments Passed to Response Programs While Generating Aggregated
Alerts
DescriptionAlert Value/FormatAlert Field TypeAlert Field
Response Program
Argument
The number of
template alerts
aggregated as part of
the aggregated alert.
<number of
alerts>
IntegerThe number of alerts
in the aggregated
alert
argv [10]
Process ID (pid) of the
attacker.
<pid>
IntegerAttacker process id
argv [11]
Parent Process ID
(ppid) of the attacker.
<ppid>
IntegerAttacker parent
process id
argv [12]
User ID (uid) of the
attacker.
<uid>
IntegerAttacker user ID
argv [13]
Group ID (gid) of the
attacker.
<gid>
IntegerAttacker group ID
argv [14]
Effective User ID
(euid) of the attacker.
<euid>
IntegerAttacker effective
user ID
argv [15]
Effective Group OD
(egid) of the attacker.
<egid>
IntegerAttacker effective
Group ID
argv [16]
Full pathname of the
attack program. If it is
a multi-process alert,
then the full
pathname of the
ancestor program.
<pathname>
StringAttack program
pathname
argv [17]
File type of the attack
program.
Corresponds to an
enum vtype value
defined in vnode.h.
<filetype>
IntegerAttack program file
type
argv [18]
File mode of the
attack program.
<file mode>
IntegerFile mode
argv [19]
Owner of the attack
program (uid).
<uid>
IntegerAttack program
owner
argv [20]
Group of the attack
program (gid).
<gid>
IntegerAttack program
group
argv [21]
Inode number of the
attack program.
<inode>
IntegerAttack program
inode number
argv [22]
Device number of the
attack program.
<device number>
IntegerAttack program
device number
argv [23]
Number of arguments
passed to the attack
program.
<number of
arguments>
IntegerNumber of
arguments
argv [24]
Program arguments
of the attack program.
<program
arguments>
StringAttack program
arguments
argv [25]
Name of pty on
which the attacker is
or was connected to.
Set to empty string if
not known.
<pty>
StringName of pty
argv [26]
How Automated Response Works in HP-UX HIDS 165