HP-UX Host Intrusion Detection System Version 4.3 administrator guide

3. Edit the value in the text box. In general, the value cannot be null.
4. Click OK to accept the new value and Cancel to leave the value unchanged.
c. To delete a current value
1. Highlight one of the values in the Edit List display. If you highlight more than one,
the first one is processed.
2. Click the Delete button. The value is deleted. Lists can be empty.
Undoing and Redoing Changes
You can roll back and forth for the changes you have made by using the Undo and Redo buttons.
For more information, see “Undoing and Redoing Changes” (page 63) for details.
Suggested Best Practices
The default configurations for the templates in HP-UX HIDS may result in generation of many
alerts. You may wish to fine-tune the operation of the templates to maximize detection of
intrusions while minimizing spurious alerts (also termed “false positives”).
Use the tune command provided by idsadmin to fine-tune schedules automatically. For
information on using the tune command, see “Tuning Schedules Using the idsadmin Command”
(page 179)
It is important to realize that the throughput of HP-UX HIDS is affected by the combination of
templates activated at a given time. Some templates have more complex heuristics and will
impose a larger overhead on the system.
It may require a number of iterations to obtain a well-tuned set of templates for a given system.
HP recommends the following best practices:
• Identify the critical resources on the system that must be protected. You can use the tune
command to tune the templates to focus on these critical resources.
• Determine when the system is most vulnerable to threats. Create a surveillance schedule to
be active during the vulnerable time periods.
• Determine if the system is in a maintenance mode at any time. Create a surveillance schedule
that is not active during maintenance time period.
• During initial deployment of HIDS, customize a sample surveillance schedule and run it
for at least one day. After a sizable number of alerts are generated, run the tune command
to determine how many alerts are generated during normal system usage. The tune
command provides you with suggested filters to filter out these alerts that are generated
because of normal system activity.
You can continue the process of tuning schedules whenever you notice that HIDS is
generating a number of 'false positives.'
Some Template Configuration Guidelines
• The “Race Condition Template” (page 125) imposes the highest overhead in terms of CPU
and memory consumption. HP recommends not to include this template in the initial
schedule.
NOTE: The race condition template checks, among other things, for the execution of setuid
scripts, which are vulnerable to a race condition attack. In HP-UX 11i version 1.6 and later,
the execution of setuid scripts is prevented by default by the secure_sid_scripts
tunable kernel parameter. See the secure_sid_scripts(5) manpage for details.
• The template “Modification of files/directories Template” (page 129), provides real-time file
change detection. Any modification made to any files or directories within the directory tree
specified in the template will be detected and reported. However, the template can generate
Configuring Detection Templates 69