HP-UX Host Intrusion Detection System Version 4.7 Administrator Guide HP-UX 11i v3 (766144-001, March 2014)
Table 38 Repeated Failed Su Attempts Alert Properties (continued)
DescriptionAlert Value/FormatAlert Field
Type
Alert FieldResponse
Program
Argument
Detailed alert descriptionUser <username> had more than
<max_failed_su> failed su
StringDetailsargv[8]
attempts in the past <number>
[second | minute | hour | day |
week]. Targets were [ <username>
<username> .... ]
The event that triggered the alert.Failed switch-user (su)StringEventargv[9]
Indicates a failed su alert versus a
failed login alert
2IntegerFlagargv[10]
The tty from which a failed su
attempt was made
<tty>StringDeviceargv[11]
The name of the user attempting to
su
<username>StringFromargv[12]
The target user of the last failed su
attempt
<username>StringToargv[13]
Limitations
The Repeated Failed su Commands Template has no limitations.
Log File Monitoring Template
How this template is useful
Log files are critical files because applications or the system typically logs messages that can
indicate they are compromised or misused by unauthorized users. This template enables
administrators to receive real-time alerts when log entries considered either critical or indicative
of an intrusion or misuse are logged in a plain text log file. Administrators specify the path names
of the log files to monitor and the patterns to monitor for each log file.
How this template is configured
Table 39 (page 145) lists the configurable properties that this template supports. Each property can
be specified for each log file being monitored. See examples below.
Table 39 Log File Monitoring Template Properties
DescriptionDefault ValueTypeName
The absolute pathname of the log file
being monitored.
/opt/apache/logs/error_logXIlogfile
Regular expression string patterns that
specify log entries of interest.
“authentication failure for"Xwatch
Regular expression string patterns to
selectively filter out log entries that
matched a "watch" pattern.
"user ids"Xignore
Severity of alert generated when a log
entry of interest is detected.
2VIIIseverity
If a log entry matches a string pattern in the watch property and does not match a string pattern
in the ignore property, then an alert is generated. If a log entry matches a string pattern in the
watch property as well as a string pattern in the ignore property, then the log entry will be ignored
and an alert will not be issued. The watch and ignore properties are optional. However, the
Log File Monitoring Template 145