HP-UX Host Intrusion Detection System Version 4.3 administrator guide

For example, you may select Monday, Tuesday, Friday, and Sunday.
7. In the Select Times panel, choose the hour blocks in which the group should run.
This is a list, so you can use left-click to pick a hour, Shift-left-click to add in all intervening
hours, and Ctrl-left-click to add or remove individual hours. For more detail, see “Selecting
with the Mouse” (page 98).
You can also use:
• All to select all 24 hours
• None to deselect all 24 hours
For example, you could select 01:00 - 04:59, 07:00 - 07:59, and 09:00 - 16:59.
8. As days and times are selected, the day-time matrix in the Schedule Summary panel is filled
in with the names of the active groups in each box. The matrix shows the sum of all the
timetables for all the groups in the selected surveillance schedule. Boxes with at least one
active group are colored green. The Schedule Summary panel is read-only.
NOTE: A schedule group cannot run on different hours on different days. To do this, copy the
group and schedule the identical groups to separate times and days.
Canceling Changes
The Cancel button allow you to delete all the changes you have made to group timetables. The
button is greyed out when there is nothing to cancel.
NOTE: If you switch to the Configure tab, the changes are set and the button is greyed out
when you return to the Timetable tab.
Saving a Surveillance Schedule
See “Saving a Surveillance Schedule” (page 63).
Configuring Alert Aggregation
Alert aggregation can reduce the overall number of alerts for better manageability, while
maintaining a detailed description of each potential intrusive activity.
Alert aggregation is a surveillance schedule feature that, when enabled, aggregates file related
alerts triggered by the same process or by multiple related processes. When a surveillance schedule
has alert aggregation enabled, thousands of file related real-time alerts triggered by a process or
group of related processes can be aggregated into a single aggregated alert. Alert aggregation
facilitates the administrator’s task of analyzing alerts by reducing the total number of alerts
issued. For example, without alert aggregation, a rm /etc/* command generates multiple
real-time alerts for deleting files that are specified as read-only by the Modification of
files/directories detection template. With alert aggregation enabled, a single aggregated alert is
issued to capture the deletion of all the files by the same process executing the rm command.
Alert aggregation can be configured to aggregate alerts triggered by a process running a specified
program and by the process descendent processes (that is, child process, grandchild process,
and so on) . For example, installing a bundle using the swinstall command can trigger many
alerts by a process running swagent in addition to the alerts triggered by swagent’s descendent
processes. The swagent descendent processes run commands in the control scripts associated
with the bundle. This feature, therefore, allows all alerts triggered by a single action (installing
software) to be issued in a single aggregated alert instead of being issued as potentially hundreds
or thousands of real-time alerts triggered by multiple processes. When alert aggregation is
72 Using the Schedule Manager Screen