HIDS - how to ignore file modification by particular executable

[Martin Geil]

I am running HIDS 2.2 on HPUX 11i, and have managed to eliminate most of the false alarms for my configuration. However, I have a process running which modifies /etc/syslog.conf once per hour to rotate a logfile. I want to monitor changes to /etc/syslog.conf EXCEPT this expected periodic change. However, I cannot define the absolute path of the executable permanently because it runs out of a versioned directory that is likely to be updated every few months. Wildcards do not appear to be valid for specifying executable names to exclude from monitoring in the same way that they are for filenames. I suppose I could just put the whole pathname of the executable including the versioned directory in the template, and change it every time the version updates, but I would rather not have to keep modifying the template.

If there is not a way to use wildcards, perhaps there is a way of scripting the template change and the push to the agents so I can automate the process of enabling a new version?

What is the release date of v3.0, and does it allow this kind of exclusion?

What are the chances of creating a HIDS agent for Solaris? It would be nice to use just 1 tool for monitoring access to sensitive operating system files like /etc/passwd. As far as I can tell, for Solaris I'll need to buy Tripwire or something like it to achieve this.

[Gratien D'haese_2]

To extend the request I could add the following:
* it would be nice to watch for file modifications of 1 type of file only, .e.g. the .profile in the users home directories, but I'm not interested in the complete /home directory.
* please add the wildcard functionality to rule "modification of files/directories", especially for the "watch these files for modification/creation". Currently, according the format definitions this is not possible as it must be a full path!
* will this added to HIDS A.03?

thx, Gratien

[Pierre Pasturel]

V3.0 supports Unix regular expressions for specifying file names and program names.

V3.0 is due out before the end of the calendar year. I will post a notice on this forum when it is available on software.hp.com.

Pierre