HP-UX Host Intrusion Detection System Version 4.7 Administrator Guide HP-UX 11i v3 (766144-001, March 2014)

3. Edit the value in the text box. In general, the value cannot be null.
4. Click OK to accept the new value and Cancel to leave the value unchanged.
c. To delete a current value
1. Highlight one of the values in the Edit List display. If you highlight more than one,
the first one is processed.
2. Click the Delete button. The value is deleted. Lists can be empty.
Undoing and Redoing Changes
You can roll back and forth for the changes you have made by using the Undo and Redo buttons.
For more information, see “Undoing and Redoing Changes” (page 53) for details.
Suggested Best Practices
The default configurations for the templates in HP-UX HIDS may result in generation of many alerts.
You may wish to fine-tune the operation of the templates to maximize detection of intrusions while
minimizing spurious alerts (also termed “false positives”).
Use the tune command provided by idsadmin to fine-tune schedules automatically. For information
on using the tune command, see “Tuning Schedules Using the idsadmin Command” (page 167).
It is important to realize that the throughput of HP-UX HIDS is affected by the combination of
templates activated at a given time. Some templates have more complex heuristics and will impose
a larger overhead on the system.
It may require a number of iterations to obtain a well-tuned set of templates for a given system. HP
recommends the following best practices:
• Identify the critical resources on the system that must be protected. You can use the tune
command to tune the templates to focus on these critical resources.
• Determine when the system is most vulnerable to threats. Create a surveillance schedule to be
active during the vulnerable time periods.
• Determine if the system is in a maintenance mode at any time. Create a surveillance schedule
that is not active during maintenance time period.
• During initial deployment of HIDS, customize a sample surveillance schedule and run it for at
least one day. After a sizable number of alerts are generated, run the tune command to
determine how many alerts are generated during normal system usage. The tune command
provides you with suggested filters to filter out these alerts that are generated because of
normal system activity.
You can continue the process of tuning schedules whenever you notice that HIDS is generating
a number of 'false positives.'
Some Template Configuration Guidelines
• The “Race Condition Template” (page 115) imposes the highest overhead in terms of CPU and
memory consumption. HP recommends not to include this template in the initial schedule.
NOTE: The race condition template checks, among other things, for the execution of setuid
scripts, which are vulnerable to a race condition attack. In HP-UX 11i version 1.6 and later,
the execution of setuid scripts is prevented by default by the secure_sid_scripts tunable
kernel parameter. See the secure_sid_scripts(5) manpage for details.
• The template “Modification of files/directories Template” (page 119), provides real-time file
change detection. Any modification made to any files or directories within the directory tree
specified in the template will be detected and reported. However, the template can generate
many alerts, which are not security relevant. The “Files Modified by Program List/Program
List” properties can be used to ignore changes to certain files when they are performed by a
Configuring Detection Templates 61