HP-UX Host Intrusion Detection System Version 4.3 administrator guide

E The Surveillance Schedule Text File
This appendix describes the surveillance schedule in text format to enable administrators to edit
surveillance schedules using their preferred editor, instead of using the GUI Schedule Manager,
for those administrators who want to automate the activation of surveillance schedules (using
scripts) instead of using the GUI System Manager.
The following topics are discussed in this appendix:
• “Getting Started” (page 197)
• “Automating the Activation of Surveillance Schedules” (page 197)
• “Surveillance Schedule Text File” (page 198)
• “Surveillance Schedule Section” (page 198)
• “Surveillance Group Section” (page 200)
Getting Started
For deployments that do not have an X window environment or where the activation of
surveillance schedules needs to be automated, HP-UX HIDS provides a means to edit and activate
surveillance schedules without the use of the HP-UX Administrator GUI.
A surveillance schedule is normally created using the GUI Schedule Manager (see “Configuring
Surveillance Schedules” (page 60)) and activated using the GUI System Manager (see “Activating
Schedules on Agent Hosts” (page 53)). The GUI System Manager saves any newly created or
modified schedule or group files to a corresponding text file in a directory. You can also choose
to edit surveillance schedules using a preferred editor instead of using the GUI Schedule Manager
or the GUI System Manager.
To avoid constructing a surveillance schedule text file from scratch, start with one of the predefined
schedules in /etc/opt/ids/schedules and the corresponding group(s) in /etc/opt/ids/
schedules/groups. Each group is defined in an individual file and can be used across multiple
schedules.
NOTE: The schedules in /etc/opt/ids/schedules/sample and the groups in /etc/opt/
ids/schedules/sample/groups are read-only copies of the predefined schedules and groups
in /etc/opt/ids/schedules and /etc/opt/ids/schedules/groups, respectively. The
read-only versions can be copied if an unmodified predefined schedule or group is ever needed
when creating a new schedule or group from scratch.
Automating the Activation of Surveillance Schedules
The idsadmin command can be used to automate the activation of surveillance schedules. The
idsadmin command supports an interactive interface and a non-interactive interface. The
activation of schedules can be scripted by using the command’s --activate and -a options.
Use the --activate option to specify the name of the surveillance schedule and -a option to
specify the name or IP address of the agent host(s). For example, the following idsadmin
command activates a schedule specified in a file named MySchedule.txt on an agent host
with IP address 10.0.0.2:
# /opt/ids/bin/idsadmin --activate MySchedule -a 10.0.0.2
For more information about the idsadmin command, see idsadmin( 1m).
Getting Started 197