HP-UX Host Intrusion Detection System Version 4.3 administrator guide

Example C-10 5. To generate a report for all agents listing only alerts related to failed logins,
logouts, and failed su attempts. The report is emailed to the specified email address with a
customized message and subject line.
/opt/ids/bin/idsadmin –r --alert-events flogin, logout, fsu
--email-to [e-mail] --email-message “HIDS Alert
Report Generated” --email-subject “Report Dated Mar 23
2007”
Example C-11 To generate a report for all agents listed in the sentinal.hosts file starting from
January 01 2007, displaying only the specified fields. The report is in raw format and emailed to
the specified email address.
/opt/ids/bin/idsadmin -r -a all --start-date 20070101
--report-format raw --email-to [e-mail] --alert-fields
localdate,attacker,target,action,uid
Figure C-4 is a screenshot of the generated report in raw format with alert fields separated by
the default delimiter pipe (|) character:
Figure C-4 Screenshot of the Generated Report in .raw Format
Benefits of Generating Reports in raw Format
Generating reports in raw format can be useful in the following scenarios:
• To automate some administrative change management tasks. For example, a script, which
compares a list of files that are expected to change with the actual files that were modified,
can read reports in raw format.
• To easily parse alerts for further manipulation, such as automating the entry of alerts in a
database to perform more complex database queries and to leverage the reporting features
of a database application.
NOTE: If some of the alert fields contain the pipe (|) character (the default delimiter character)
use the --report-delimiter option to specify a different delimiter character. Using pipe (|)
as a delimiter when alert fields contain the pipe (|) symbol will disrupt the parsing of alerts.
190 Tuning Schedules and Generating Alert Reports