topic Re: HIDS Template Creation in Operating System - HP-UX

HIDS Template Creation

Andrew Pollard — Tue, 07 Dec 2004 15:40:20 GMT

Hi,

I'm just learning HIDS and I am wondering if it is possible to:
1)Create my own templates
2)Create a template that will monitor the "kill" command

Any information will be a great help.

Thanks
Andrew

Re: HIDS Template Creation

Pierre Pasturel — Wed, 08 Dec 2004 13:32:07 GMT

Andrew -

The answer to both those questions is no.

1) What kind of templates did you have in mind?
2) Why monitor this command?

Pierre

Re: HIDS Template Creation

Andrew Pollard — Fri, 10 Dec 2004 11:58:37 GMT

Hi,

The reason I wanted to know about creating templates was that I wasn't sure if the templates provided will cover all our needs, whatever they would be.

I do have another question:
I setup a Test Schedule, a Test Surveillence Group, and assigned 2 basic templates that I edited to monitor specific files and directories. I let it run for 2 days and checked it today and the templates in the Surveillence Group had changed to Race Conditions and Buffer Overflow, and the editing I did to the templates I wanted were gone.
Is there a special way to save my changes? They saved fine and ran fine on the day I did them, what would have changed?

Thanks
Andrew

Re: HIDS Template Creation

Pierre Pasturel — Mon, 13 Dec 2004 14:29:42 GMT

Andrew-

When you select your Surveillance Schedule in the Schedule Manager window, the corresponding Test Group will be checkmarked but (unforunately) will not also be highlighted. Instead, the AdvancedGroup group is highlighted, which contains the race condition and buffer overflow templates.

You need to explicitly highlight (by clicking on the Test Group name), after which you should see your customizations.

If you activate your Test schedule, you should see the correct templates and settings in /var/opt/ids/schedule on your agent host(s).

Pierre