HP-UX Host Intrusion Detection System Version 4.3 administrator guide

Figure 5-7 Rename Surveillance Group Dialog
4. Edit the name in the input field. Valid characters are alphanumeric and underscore. The
first character must be alphanumeric. Group names are case-sensitive. If you include invalid
characters, you will be prompted to replace them with underscores.
5. Click OK to change the name and Cancel to leave the name unchanged.
Deleting a Surveillance Group
This section provides steps to delete a Surveillance Group.
NOTE: You cannot delete any predefined group, distributed with HP-UX HIDS. See “Predefined
Surveillance Schedules and Groups” (page 80).
To delete a surveillance group, follow the steps:
1. On the Schedule Manager screen select Configure tab.
2. Select the group in the Surveillance Groups panel.
3. Click the Delete button in the Surveillance Groups panel. This displays the Confirm Deletion
dialog box.
Click Yes to delete the group. Click No to retain the group.
Undoing and Redoing Changes
You can roll back and forth for the changes that you have made by using the Undo and Redo
buttons. For more information, see “Undoing and Redoing Changes” (page 63).
Saving a Surveillance Group
The newly created Surveillance Group is automatically saved when you save any schedule
(“Saving a Surveillance Schedule” (page 63)) and every time you exit from the System Manager
screen.
Configuring Detection Templates
Detection templates are the building blocks of surveillance groups. They contain configurable
properties that modify template behavior during run time.
See Appendix A (page 111) for more information about HP-UX HIDS detection templates, and
how they can be configured.
Each detection template is designed to identify a specific type of unauthorized system activity
and has configurable parameters. The detection template directs the agent to monitor a security
related activity on a host system.
For example, a Failed Login detection template checks the number of failed logins within a given
time interval on a host system. Both the number of failed login attempts and the time interval
are configurable. If a user fails to correctly login and the triggering criteria are met, an alert is
issued.
66 Using the Schedule Manager Screen