HP Host Intrusion Detection System (HIDS) manual Successful su Detected, 170

Templates and Alerts

Login/Logout Template

Table A-20	Login/Logout Alert Properties (Continued)
Response	Alert	Alert
Program		Field	Alert Value/Format	Description
	Field
Argument		Type
argv[10]	Flag	Integer	1	Indicates a
				login/logout alert
				versus an su alert.
argv[11]	User	String	<username>	Name of user that
				logged in or logged
				out.
argv[12]	Device	String	<pty device name>	Name of pty
				device associated
				with login session.
argv[13]	Hostname	String	<remote hostname>	Name of remote
				host from which
				login was
				initiated.
argv[14]	IP	String	<A.B.C.D> for IPv4 addresses	IP address of
	Address		"A:B:C:D:..." for IPv6 addresses	remote host from
				which login was
				initiated.

Successful su Detected

This template generates and forwards the following alerts to a response program when a successful switch user (su) command is executed:

Table A-21		Successful su Detected Alert Properties
	Response	Alert	Alert
	Program		Field	Alert Value/Format	Description
		Field
	Argument		Type
	argv[1]	Template	Integer	7	Unique code
		code			assigned to
					template
	argv[2]	Version	Integer	2	Version of the
					template
	argv[3]	Severity	Integer	2 for user root or ids; 3 for all other users	Severity
	argv[4]	UTC Time	Integer	<secs>	UTC time in
					number of
					seconds since
					epoch when a
					successful su
					event occurs.

170 Appendix A