HP-UX Host Intrusion Detection System Version 4.7 Administrator Guide HP-UX 11i v3 (766144-001, March 2014)

NOTE: The /etc/opt/ids/schedules/sample/groups directory contains read-only copies
of the predefined surveillance groups. Users who want to revert back to the original predefined
surveillance groups can manually copy them from /etc/opt/ids/schedules/sample/groups
into /etc/opt/schedules/groups.
Creating a New Surveillance Group
To create a new surveillance group, follow the steps:
1. On the Schedule Manager screen select the Configure tab.
2. Create a new name for the new surveillance group using the following steps:
a. Click the New button on the Surveillance Groups panel. This opens the New Surveillance
Group dialog box (Figure 10).
Figure 10 New Surveillance Group Dialog
b. Enter a name in the input field. Valid characters are alphanumeric and underscore; the
first character must be alphanumeric. Surveillance group names are case-sensitive. If you
include invalid characters, you will be prompted to have them replaced with underscores.
c. Click OK to accept and Cancel to exit the dialog box.
A new group is initialized with no templates selected. All template properties have their default
values.
3. To set up the new group, use the steps in “Modifying a Surveillance Group” (page 57).
Copying a Surveillance Group
If an existing surveillance group is similar to what you want, you can copy the group and rename
it, or directly edit the existing group. For example, if you wanted a group to run from 9 a.m. to 5
p.m. Monday through Friday . On Saturday and Sunday, the group must run for 24 hours. To set
this schedule for Saturday and Sunday, copy the Monday-Friday group and set a different timetable
in the Saturday-Sunday group.
To copy a surveillance group, follow the steps:
1. On the Schedule Manager screen select the Configure tab.
2. Select the group you want to copy in the Surveillance Groups panel.
56 Using the Schedule Manager Screen