![](/images/new-backgrounds/1308409/308409423x1.webp)
Automated Response
Sample Response Programs
NOTE
IMPORTANT
Preservation of evidence
Consult your local legal counsel to determine what steps must be taken to preserve evidence for use in court. The example scripts presented below do not meet the legal requirements for preservation of evidence.
Putting a process to sleep It may be necessary to preserve the evidence of an intrusion for later analysis. In this example, a process which has caused an alert will be stopped. Any activity by the process will be halted; the process's memory image can be analyzed at a later time.
This script requires privilege and should not be installed as a setuid privileged script. This script is for illustration purposes only. Please refer to “Writing Privileged Response Programs” on page 190 for help on how to safely write a privileged response program.
#!/usr/bin/sh
##Sample
##Stop a process which has performed an intrusive activity. RECIPIENT=”root”
#If we have a file modification alert if [ $1 = “2” ]
then
#and if the target of the attack is the password file if [ ${17} = “/etc/passwd” ]; then
#obtain the process id from the alert pid=${11}
echo “Critical intrusion: halting process ${pid} running ${24} t hat modified /etc/passwd” \
/usr/bin/mailx
fi
fi
200 | Appendix B |