HP-UX Host Intrusion Detection System Version 4.4 Administrator Guide (5900-1634, April 2011)

3. Click the Rename button in the Surveillance Groups panel to open the Rename Surveillance
Group dialog box (Figure 12).
Figure 12 Rename Surveillance Group Dialog
4. Edit the name in the input field. Valid characters are alphanumeric and underscore. The first
character must be alphanumeric. Group names are case-sensitive. If you include invalid
characters, you will be prompted to replace them with underscores.
5. Click OK to change the name and Cancel to leave the name unchanged.
Deleting a Surveillance Group
This section provides steps to delete a Surveillance Group.
NOTE: You cannot delete any predefined group, distributed with HP-UX HIDS. See “Predefined
Surveillance Schedules and Groups” (page 75).
To delete a surveillance group, follow the steps:
1. On the Schedule Manager screen select Configure tab.
2. Select the group in the Surveillance Groups panel.
3. Click the Delete button in the Surveillance Groups panel. This displays the Confirm Deletion
dialog box.
Click Yes to delete the group. Click No to retain the group.
Undoing and Redoing Changes
You can roll back and forth for the changes that you have made by using the Undo and Redo
buttons. For more information, see “Undoing and Redoing Changes” (page 56).
Saving a Surveillance Group
The newly created Surveillance Group is automatically saved when you save any schedule (“Saving
a Surveillance Schedule” (page 56)) and every time you exit from the System Manager screen.
Configuring Detection Templates
Detection templates are the building blocks of surveillance groups. They contain configurable
properties that modify template behavior during run time.
For more information about HP-UX HIDS detection templates, and how they can be configured,
see Appendix A (page 103) .
Each detection template is designed to identify a specific type of unauthorized system activity and
has configurable parameters. The detection template directs the agent to monitor a security related
activity on a host system.
For example, a Failed Login detection template checks the number of failed logins within a given
time interval on a host system. Both the number of failed login attempts and the time interval are
configurable. If a user fails to correctly login and the triggering criteria are met, an alert is issued.
Configuring Detection Templates 61