HIDS Feature Improvement Survey

[Norman Nie]

As you may already know, the latest major release of HIDS - v3.0 - is currently available on software depot (please see software.hp.com for more information). It addresses the high CPU usage issue among other things.

We are now looking at subsequent releases of the product and would like to capture as much direct customer input as possible in our planning efforts. If you are interested in HP-UX HIDS and its roadmap, this survey is the best way to communicate your ideas about and suggestions for improving the product. Please be as specific and clear as possible; also, please focus on the problem/issue rather than only a solution to it; for example, rather than requesting a command line interface (CLI) for HIDS, it would be helpful to specify the need for a tool or process to automate large deployments. We also would appreciate the opportunity to contact you directly, should we need follow-on interaction to clarify your responses; please provide your contact information (last question) or indicate if you do not wish to receive follow-on communications. Thank you in advance for time and input.

1. Described your deployment environment for HIDS. Please be sure to include information about the number of agents and GUI stations; class, size and HP-UX version of systems HIDS components running on; types of applications running on each system monitored by HIDS (e.g., HR, finance, data base, etc.); how you manage your HIDS infrastructure (via OpenView (HIDS SPI), HIDS GUI or using idsadmin); any other information you can share.

2. Describe key product deficiencies that prevent you from utilizing HP-UX HIDS more widely and/or effectively in your environment. Note that we are asking for whole areas of functionality that are currently missing (e.g., built-in reporting of historical data, network IDS, user defined templates for application specific IDS). Please separate multiple responses and assign a letter to each response (to be used for reference in answering question 4).

3. Which existing areas and functionalities need improvement for better product experience? (e.g., better alert filtering) Please separate multiple responses and assign a letter to each response (to be used for reference in answering question 4).

4. Please rank your improvement ideas outlined in response to questions 2 and 3, along with the specific improvements ideas outlined below:
a) alert volume reduction.
b) integration with other HP-UX products (please specify other product).
c) built-in response capabilities (specify the type/nature of response).
d) separation of roles and responsibilities in idsgui: monitoring capability (to be used by operational personnel) vs. full administrative control (used by security personnel to configure/control HIDS).

(Rank order is from the highest (most important) to the lowest (least important), and would look like something as follows: 2, 4a, 3, 4d, 4c, 4b - assuming you had a single response to each of questions 2 and 3)

5. Please provide contact information in case follow-on communication is needed.

Thanks again,

HP HIDS Product Team