InTrust 11.3.2 - Preparing for Auditing and Monitoring HP-UX

Tracking Security Incidents

You want to receive daily information about possible security issues in your environment, such as brute force attack attempts.

You can achieve this by scheduling gathering and reporting jobs with InTrust.

Take the following steps:

1. Make sure that syslogd is running.
2. Create an InTrust task that gathers Syslog events from the appropriate site (gathering job) and builds reports based on the gathered data (reporting job).The resulting reports are stored in the local folder that is specified during InTrust installation (for details, see the Specifying reporting settings section in Installing the First Server in InTrust Organization in the InTrust Deployment Guide).
3. A good report for this scenario is “HP-UX Multiple failed login attempts”.
4. It is up to you whether you want to store the gathered data in an InTrust repository. You can also include a notification job to get notified of task completion.
5. Schedule the task to run every morning at a convenient time.

Data Collected from Audit Log

This topic describes the format that Audit log data is stored in. Native tools are used for converting Audit log to text, and the text entries are transformed into event records for the repository or audit database. Each event record has a fixed number of fields, which are described in the following table. These fields are always present, even if their values are empty.