HP-UX Host Intrusion Detection System Version 4.3 administrator guide

enabled, the following alerts are issued and displayed in the GUI network nodes and logged in
the alert log file (defined by the IDS_ALERTFILE configuration variable) of the agent:
• File-related aggregated alerts
• File-related real-time alerts that could not be aggregated
• Non-file-related real-time alerts
These alerts are also sent to any response programs in the response directory, as defined by the
IDS_RESPONSEDIR configuration variable described in “Global Configuration” (page 192) (the
default is /opt/ids/response). Optionally, all real-time alerts (that is, both file and
non-file-related alerts) can also be issued concurrently by the agent when aggregation is enabled.
The real-time alerts will only be sent to response programs in the real-time response directory,
as defined by the IDS_RT_RESPONSEDIR configuration variable described in “Global
Configuration” (page 192) (the default is /opt/ids/rt_response). The ability to have a separate
set of response programs that receive real time alerts preserves the HIDS ability to do real time
automated response (that does not require human intervention such as automatically killing an
offending process) while at the same time allowing an administrator to monitor fewer alerts with
alert aggregation. When a schedule is configured to issue both aggregated alerts and real- time
alerts, the response scripts in the IDS_RT_RESPONSEDIR directory are intended primarily for
performing real-time automated response that do not require human intervention. Killing an
offending process or closing a client connection are examples of responses that can be automated.
The response scripts in the IDS_RESPONSEDIR directory in turn, are intended primarily for
reporting alerts (by email to an administrator, or to the OVO console using the HIDS OVO/SPI)
for human consumption.
Alert aggregation is enabled by default for all newly created and predefined surveillance
schedules. It can be configured either by using the GUI Schedule Manager window, or by editing
a schedule in text format. See “Surveillance Schedule Text File” (page 198) for more information
on the schedule in text format.
To enable and configure Alert Aggregation, follow these steps:
1. Select a schedule in the Schedules panel.
Figure 5-13 Schedule Manager Screen-Alert Aggregation Tab
2. Select the Alert Aggregation tab on the Schedule Manager screen.
3. Select the Alert Aggregation option box to enable alert aggregation.
Configuring Alert Aggregation 73