HP-UX Host Intrusion Detection System Version 4.4 Administrator Guide (5900-1634, April 2011)

Table 38 Repeated Failed Su Attempts Alert Properties
DescriptionAlert Value/FormatAlert Field
Type
Alert FieldResponse
Program
Argument
Unique code assigned to template9IntegerTemplate codeargv[1]
Template version<version>IntegerVersionargv[2]
Alert severity2 for users listed in the
priv_user_list property. 3 for
all other users.
IntegerSeverityargv[3]
UTC time in number of seconds
since the epoch when more than
<max_failed_su> number of failed
su attempts were detected for a
particular user
<secs>IntegerUTC timeargv[4]
The name of the user attempting to
su.
<username>StringAttackerargv[5]
The target user of the last failed su
attempt
<username>StringTargetargv[6]
Alert summaryFailed su attemptsStringSummaryargv[7]
Detailed alert descriptionUser <username> had more than
<max_failed_su> failed su
attempts in the past <number>
[second | minute | hour | day |
week]. Targets were [ <username>
<username> .... ]
StringDetailsargv[8]
The event that triggered the alert.Failed switch-user (su)StringEventargv[9]
Indicates a failed su alert versus a
failed login alert
2IntegerFlagargv[10]
The tty from which a failed su
attempt was made
<tty>StringDeviceargv[11]
The name of the user attempting to
su
<username>StringFromargv[12]
The target user of the last failed su
attempt
<username>StringToargv[13]
Limitations
The Repeated Failed su Commands Template has no limitations.
Log File Monitoring Template
How this template is useful
Log files are critical files because applications or the system typically logs messages that can
indicate they are compromised or misused by unauthorized users. This template enables
administrators to receive real-time alerts when log entries considered either critical or indicative
of an intrusion or misuse are logged in a plain text log file. Administrators specify the path names
of the log files to monitor and the patterns to monitor for each log file.
How this template is configured
Table 39 (page 148) lists the configurable properties that this template supports. Each property can
be specified for each log file being monitored. See examples below.
Log File Monitoring Template 147