HP-UX Host Intrusion Detection System Version 4.4 Administrator Guide (5900-1634, April 2011)

• aggr_tuples: The aggr_tuples property is a set of alert aggregation tuples that can be
configured to aggregate alerts triggered by a process running a specified program with alerts
triggered by the process’ descendent processes. The property tuple values are specified using
the syntax described in “Type IX: Path Names / Integer Pairs” (page 112) and each tuple is
equivalent to a row in the Schedule Manager Alert Aggregation table described in “Configuring
Alert Aggregation” (page 67).
• suppression: The suppression property is a duplicate alert suppression property that is
used to enable or disable duplicate alert suppression. The property value is specified using
the syntax described in “Type VII: Flags” (page 112) and is equivalent to the Schedule Manager
Duplicate Suppression option described in “Configuring Duplicate Alert Suppression” (page 71).
The property set to 1 is equivalent to the Duplicate Alert Suppression box that is selected in
the GUI Schedule Manager. The property set to 0 is equivalent to the Duplicate Alert
Suppression box that is not selected.
• suppression_report: The suppression_report property is a duplicate alert suppression
property that enables or disables reporting of a summary of suppressed alerts. This property
is equivalent to the Schedule Manager Generate Suppression Report option described in
“Configuring Duplicate Alert Suppression” (page 71). This property when set to 1 is equivalent
to the Generate Suppression Report box that is selected in the GUI Schedule Manager. This
property when set to 0 is equivalent to the Generate Suppression Report box that is not selected.
This property is ignored if the suppression property is set to 0.
• suppression_interval: The suppression_interval property is a duplicate alert
suppression property that specifies the time (since the first suppressed duplicate alert) during
which duplicate alerts of a unique alert are suppressed. After the specified time, HIDS generates
a report summary. However, if the number of duplicate alerts exceed the number specified in
the suppression_count property (see below), a summary of duplicate alerts can be
generated earlier than the time specified in suppression_interval. This property is
equivalent to the Suppression Interval field in the GUI Schedule Manager. The default value
of this property is 6h. This means that when suppression is turned on, by default HIDS
suppresses duplicate alerts for a unique alert for 6 hours unless the number of duplicates
suppressed exceeds the number specified in the suppression_count property. This property
is ignored if the suppression property is set to 0.
• suppression_count: The suppression_count property is a duplicate alert suppression
property that specifies the number of duplicate alerts that can be suppressed within the specified
suppression interval (for a unique alert), after which, a summary of duplicate alerts can be
reported. This property is equivalent to the Suppression Count field in the GUI Schedule
Manager. The default value of this property is 100. This means that HIDS sends a report if
there are 100 or more suppressed alerts (after the first duplicate alert is suppressed) for a
unique alert within the specified suppression_interval. This property is ignored if the
suppression property is set to 0.
• suppression_targets_to_ignore: The suppression_targets_to_ignore property
is a duplicate alert suppression property that specifies the files and directories for which
duplicate alerts are not suppressed. This property is equivalent to the Suppression Targets to
Ignore field in the GUI Schedule Manager. This property is ignored if the suppression
property is set to 0. By default, duplicate alerts for the following property values (these are
interpreted as regular expressions) are not suppressed:
◦ ^/etc/passwd$
◦ ^/etc/group$
◦ ^/stand/vmunix$
◦ ^/stand/system$
◦ ^/\.rhosts$
◦ ^/etc/inetd\.conf$
• monitor_failed_attempts: This property is used to either enable or disable the monitoring
of failed attempts to create, modify, or delete critical files. The property value is specified
194 The Surveillance Schedule Text File