HP-UX Host Intrusion Detection System Version 4.7 Administrator Guide HP-UX 11i v3 (766144-001, March 2014)

B Automated Response for Alerts
This appendix describes how to use response programs to process alerts automatically according
to your installation policy. It includes a sample C program, several sample response scripts, and
information about a prepackaged response program that communicates with HP OpenView
VantagePoint Operations. This appendix addresses the following topics:
• “How Automated Response Works in HP-UX HIDS” (page 149)
• “Programming Guidelines” (page 155)
• “Sample Response Programs” (page 160)
• “HP OpenView Operations SMART Plug-In” (page 165)
Response programs enable you to capture alerts automatically as they are generated by the HP-UX
HIDS agent, and to use your own tools to process them and make decisions, such as alerting a
system administrator about a potential intrusion. Response programs work in addition to the normal
agent-administration interface of HP-UX HIDS, in which alerts are reported to the System Manager
process on the administration system.
The response programs are executed on the agent system that generates the alert, thus enabling
near real-time intrusion response in the face of potential misuse.
Consider the following guidelines when responding to an intrusion attempt on a system:
• Do not do anything that is illegal in your region of the world.
Consult your local legal counsel before devising response strategies.
• Balance the response against the threat.
Not every target of an attack justifies an equal response; configure responses in proportion
to threats.
• Determine whether attack isolation is more important than continuous availability.
In response to an attack, you can disable networking on a server to isolate it from further
attacks. This isolation also serves to preserve any evidence of an intrusion. However, by
isolating the server, you can interfere with legitimate business activities.
Response Methods
Responses to intrusions use one of the following methods.
• Forwarding Information
Information about the alert can be forwarded by sending an e-mail or calling a pager. Filtering
is required to prevent repeated alerts from causing a storm of pages. For examples, see
“Forwarding Information” (page 160).
• Halting Further Attacks
Automated response can halt further attacks by changing an attribute of the system. For
example, disabling an account, disabling remote logins, or changing a directory's access
permissions. For examples, see “Halting Further Attacks” (page 161).
• Preservation of Evidence
If evidence is to be preserved and analyzed, a response script can halt all further processing
on the system. Alternatively, it can disable network connections so that the system is preserved
in a running state. For examples, see “Preserving Evidence” (page 163).
• System Restoration to a Stable State
If business continuity is important, the system must be restored to a stable state. If critical files
are modified, they can be restored from trusted read-only media. For examples, see “System
Restoration to a Stable state” (page 164).
148 Automated Response for Alerts