HP-UX Host Intrusion Detection System Version 4.3 administrator guide

Alerts Tab
The Alerts tab shown in Figure 7-1 displays the alerts that were detected by the surveillance
schedule on one of the agent host systems.
On the Network Node screen, click the Alerts tab.
Figure 7-1 Network Node Alerts Tab
Each alert entry displays the alert severity, the attacker, the attack type, the date and time the
alert was generated, and other data. The columns displayed depend on selections on the
Preferences screen, which lists and describes all the column names. For more information see
“Alert Events Preferences” (page 106).
Alerts are highlighted with color bars to emphasize the severity level of the potential attack (your
colors may vary).
Red (severity 1) This is a critical alert. A critical alert indicates a direct and
immediate compromise of a system.
Yellow (severity 2) This is a severe alert. A severe alert can indicate an attack that can
compromise the system, but without fatal consequences.
Blue (severity 3) This is a moderate alert. A moderate alert can provide information
about an event that can be used to carry out a more severe attack
on the system.
When you select an alert, regardless of its severity, it is highlighted in light blue and marked as
Seen. The panel below the list of alerts shows the detailed description of the last selected alert.
The operations you can perform on the Alerts tab are described in “General Operations” (page 97).
HP-UX HIDS Alerts
Your response to each alert depends on individual circumstances. Develop policies and procedures
for handling intrusions.
The templates used to generate alerts are described in Appendix A (page 111).
96 Using the Network Node Screen