HP-UX Host Intrusion Detection System Version 4.3 administrator guide

2. Select the schedule in the Schedules panel.
3. Save the schedule by using one of the following options:
• Click the Save button
• Choose File > Save Selected Schedule
Configuring Surveillance Groups
Surveillance groups are the building blocks of surveillance schedules. They are made up of one
or more detection templates. You can create, edit, modify. or delete surveillance groups. You
can also choose to edit one of the predefined surveillance groups.
NOTE: The /etc/opt/ids/schedules/sample/groups directory contains read-only
copies of the predefined surveillance groups. Users who want to revert back to the original
predefined surveillance groups can manually copy them from /etc/opt/ids/schedules/
sample/groups into /etc/opt/schedules/groups.
Creating a New Surveillance Group
To create a new surveillance group, follow the steps:
1. On the Schedule Manager screen select the Configure tab.
2. Create a new name for the new surveillance group using the following steps:
a. Click the New button on the Surveillance Groups panel. This opens the New
Surveillance Group dialog box (Figure 5-5).
Figure 5-5 New Surveillance Group Dialog
b. Enter a name in the input field. Valid characters are alphanumeric and underscore; the
first character must be alphanumeric. Surveillance group names are case-sensitive. If
you include invalid characters, you will be prompted to have them replaced with
underscores.
c. Click OK to accept and Cancel to exit the dialog box.
A new group is initialized with no templates selected. All template properties have their
default values.
3. To set up the new group, use the steps in “Modifying a Surveillance Group” (page 65).
Copying a Surveillance Group
If an existing surveillance group is similar to what you want, you can copy the group and rename
it, or directly edit the existing group. For example, if you wanted a group to run from 9 a.m. to
5 p.m. Monday through Friday . On Saturday and Sunday the group must run for 24 hours. To
set this schedule for Saturday and Sunday copy the Monday-Friday group and set a different
timetable in the Saturday-Sunday group.
To copy a surveillance group, follow the steps:
1. On the Schedule Manager screen select the Configure tab.
2. Select the group you want to copy in the Surveillance Groups panel.
64 Using the Schedule Manager Screen