HP-UX Host Intrusion Detection System Version 4.7 Administrator Guide HP-UX 11i v3 (766144-001, March 2014)
The following template configuration illustrates a Type V property value:
ip_filters | 192.168.2.0, 255.255.255.0, 0 |
Where:
192.168.2.0 network address
255.255.255.0 network mask for a network address
0 no alerts are generated for hosts in the specified network
Type VI: Time Strings
The time strings property represents time intervals. Each time string has the following syntax:
integer[units]
The integer component is a positive integer representing a time interval. The units component,
when present, indicates the time units the integer is expressed in. The following units are supported:
s Seconds
m Minutes
h Hours
d Days
w Weeks
When the unit component is not present, the integer component is assumed to be in seconds. For
example, the following lines in the template configuration file contain time strings representing
values of 23 seconds, 10 minutes, 1 hour and 23 seconds; the s component in the last line is
redundant, but can be used for clarity.
fail_interval | 23
warning_interval | 10m
fail_interval | 1h
warning_interval | 23s
NOTE: You cannot specify the time unit value in the Schedule Manager screen.
Type VII: Flags
The Type VII property value is an integer used to enable or disable a flag. A value of 1 means
enabled, and a value of 0 means disabled. For example, the following properties of the
Login/Logout template specify that the monitoring of logins is enabled, and the monitoring of
successful su commands is disabled:
monitor_login_flag | 1
monitor_su_flag | 0
Type VIII: Scalars
The Type VIII property value is a single integer. However, this value can be any integer. For
example, the following property of the Buffer Overflow template specifies that 500 is considered
an unusually long argument length when invoking a priviledged setuid program:
unusual_arg_len | 500
Type IX: Path Names / Integer Pairs
The Type IX property specifies pairs of path names and integers. In each pair, the two members
are separated by a comma and pairs are separated by a pipe. The path name is interpreted as
regular expressions and extended regular expressions. For more information on regular expressions,
see “UNIX Regular Expressions ” (page 105). The integer is interpreted to be of type Type VI: Time
Strings.
Currently, only the global alert aggregation tuples property is of this type. For more information,
see “Surveillance Schedule Text File” (page 189).
110 Templates and Alerts