<option value="/reference/dir.security1.html">Security	
			<!-- <option value="/reference/dir.ewtraining1.html">Training Guides -->
			<option value="/reference/dir.userinterfaces.html">UI
			<option value="/reference/dir.webservices.html">Web Services
			<option value="/reference/dir.webmasterskills1.html">Webmaster
			<option value="/reference/dir.y2k1.html">Y2K
			<option value="">-----------
			<option value="/reference/whatsnew.html">New Titles
			<option value="">-----------
			<option value="/reference/dir.archive1.html">Free Archive		
			</SELECT>
			</font></td>
	</tr>
	</table>
	</form>
<!-- LEFT NAV SEARCH END -->

		</td>
		
<!-- PUB PARTNERS END -->
<!-- END LEFT NAV -->

<td rowspan="8" align="right" valign="top"><img src="/images/iswbls.gif" width=1 height=400 alt="" border="0"></td>
<td><img src="/images/white.gif" width="5" height="1" alt="" border="0"></td>
<!-- end of ITK left NAV -->

<!-- begin main content -->
<td width="100%" valign="top" align="left">


<!-- END SUB HEADER -->

<!--Begin Content Column -->

<FONT FACE="Arial,Helvetica" SIZE="-1">
To access the contents, click the chapter and section titles.
</FONT>
<P>
<B>Intrusion Detection: Network Security beyond the Firewall</B>
<FONT SIZE="-1">
<BR>
<I>(Publisher: John Wiley & Sons, Inc.)</I>
<BR>
Author(s): Terry Escamilla
<BR>
ISBN: 0471290009
<BR>
Publication Date: 11/01/98
</FONT>
<P>
<form name="Search" method="GET" action="http://search.earthweb.com/search97/search_redir.cgi">

<INPUT TYPE="hidden" NAME="Action" VALUE="Search">
<INPUT TYPE="hidden" NAME="SearchPage" VALUE="http://search.earthweb.com/search97/samples/forms/srchdemo.htm">
<INPUT TYPE="hidden" NAME="Collection" VALUE="ITK">
<INPUT TYPE="hidden" NAME="ResultTemplate" VALUE="itk-full.hts">
<INPUT TYPE="hidden" NAME="ViewTemplate" VALUE="view.hts">

<font face="arial, helvetica" size=2><b>Search this book:</b></font><br>
<INPUT NAME="queryText" size=50 VALUE="">&nbsp;<input type="submit" name="submitbutton" value="Go!">
<INPUT type=hidden NAME="section_on" VALUE="on">
<INPUT type=hidden NAME="section" VALUE="http://www.itknowledge.com/reference/standard/0471290009/">

</form>


<!-- Empty Reference Subhead -->

<!--ISBN=0471290009//-->
<!--TITLE=Intrusion Detection: Network Security Beyond the Firewall//-->
<!--AUTHOR=Terry Escamilla//-->
<!--PUBLISHER=John Wiley & Sons, Inc.//-->
<!--IMPRINT=Wiley Computer Publishing//-->
<!--CHAPTER=8//-->
<!--PAGES=229-231//-->
<!--UNASSIGNED1//-->
<!--UNASSIGNED2//-->

<CENTER>
<TABLE BORDER>
<TR>
<TD><A HREF="227-228.html">Previous</A></TD>
<TD><A HREF="../ewtoc.html">Table of Contents</A></TD>
<TD><A HREF="231-234.html">Next</A></TD>
</TR>
</TABLE>
</CENTER>
<P><BR></P>
<H4 ALIGN="LEFT"><A NAME="Heading3"></A><FONT COLOR="#000077">Audit Management</FONT></H4>
<P>Configuring and maintaining audit logs on UNIX systems is no trivial matter. A number of different parameters need to be properly set. Expertise in UNIX audit administration is not a widely available skill. Furthermore, the management concepts and tasks across different UNIX systems differ widely. For example, the AIX audit subsystem provides a <I>panic</I> capability. Paranoid administrators can panic the system if there is not enough space to write audit records. There <I>are</I> people who would prefer to see the system go down rather than have an incomplete audit trail. The Audit Management subsystem of Stalker provides a GUI that attempts to hide the complexities of audit administration for several versions of UNIX. Because the concepts and tasks are not identical on all platforms, you will fill in different screens depending on the OS running on the Agent.</P>
<P>In the audit configuration screen, some of the items you can control include the following:</P>
<DL>
<DD><B>&#149;</B>&nbsp;&nbsp;When to close the current audit log and start another
<DD><B>&#149;</B>&nbsp;&nbsp;What events to record in the audit log
<DD><B>&#149;</B>&nbsp;&nbsp;Whether to turn auditing on or off
<DD><B>&#149;</B>&nbsp;&nbsp;Where to store audit records
</DL>
<P>Most UNIX systems support two modes for storing audit records. In <I>bin</I> mode, the audit subsystem writes records into the first bin (file) until it is full. The audit subsystem then switches and writes into the second bin, until it, too, becomes full, and the first bin is used again. In <I>stream</I> mode, output from the audit trail is passed in real time to system-defined processes. For example, Stalker intercepts the audit events in real time in stream mode and writes, formats the output into a common format, and then writes the data into files.</P>
<P>Processing records in bin mode can result in the loss of records. Stream mode records are lost only if the file system space fills up. Stalker configures UNIX systems to run in stream mode. The Stalker agent code then attaches to the stream and captures audit records as they are generated. When the records are reformatted into a common form, they are written into ASCII files that the detection engine analyzes. You can choose whether to keep the original audit records generated by the system as part of Audit Management.</P>
<P>On Solaris systems, you can choose to monitor more than 240 different types of audit events. Other operating systems monitor 100 event types or more. Therefore, deciding which events to monitor is your responsibility as an administrator. By default, Stalker configures Agents to monitor only a subset of events. For performance reasons, not all file opens are monitored. AIX provides per-file auditing, so it is possible to watch opens for only certain files, such as /etc/security/passwd. Unfortunately, there will be many legitimate accesses to this file as part of the normal operating system behavior, particularly if there are many logins and logouts during the day at your site. On the other hand, if you don&#146;t watch people writing to /etc/security/passwd, you can miss attacks.</P>
<H4 ALIGN="LEFT"><A NAME="Heading4"></A><FONT COLOR="#000077">Tracer/Browser</FONT></H4>
<P>Auditing subsystems generate substantially large files. Haystack Labs would suggest that customers plan for 10&#151;50 MB of data per user per day. Your mileage might vary.
</P>
<P>The <I>Tracer/Browser</I> (TB) is a query tool for filtering through these large amounts of audit data. To look for <I>specific</I> entries in the audit logs, you select a client from the GUI, click on the TB icon, and fill in the next few screens. Note that the TB is designed to search through audit logs for events that match your search parameters. It does not look for sequences or complex patterns of events.</P>
<P>The TB enables you to filter on many different fields:</P>
<DL>
<DD><B>&#149;</B>&nbsp;&nbsp;AUID, RUID, EUID, RGID, and EGID
<DD><B>&#149;</B>&nbsp;&nbsp;Object name (such as individual file names or regular expressions)
<DD><B>&#149;</B>&nbsp;&nbsp;Success or failure of the audit event
<DD><B>&#149;</B>&nbsp;&nbsp;Audit event class or type
<DD><B>&#149;</B>&nbsp;&nbsp;Source IP address if the event is for network activity
<DD><B>&#149;</B>&nbsp;&nbsp;TTY or terminal from which the user is connected
</DL>
<P>You can form very complex queries in the GUI. For each field, you may define inclusion and exclusion qualifiers, such as asking for all AUIDs not equal to zero or all file names that match a particular regular expression. Predefined lists of values for a search field are also allowed. That is, the GUI will let you create a list of critical file names to monitor, assign a name to this list, and reuse the list in different queries over time. You then can search through the audit logs looking for audit events showing attempted accesses for only those files.
</P>
<P>The output from the query can be displayed, printed, mailed, or saved to a file. When saved to a file, the format can be either a text report or an audit event file that can be <I>further reduced</I> with a query. Queries may be formulated in advance and then stored as <I>templates</I>. Scheduled TB queries are then run via cron jobs to reduce the audit data into regularly delivered reports.</P>
<P>When would you use the TB? When you want to keep records of important security events, such as when users are added or removed, a convenient report can be created in the TB. Thus, you can use TB reports for documenting your security activities. Stalker is shipped with a number of default TB queries and reports. One example is a report with both successful and failed logins. Notice that this report is not an intrusion detection signature. It&#146;s just a useful report showing you who connected and who had trouble connecting. An attack signature happens to use the same data to look for someone trying to break into the system. You might also want to know anytime someone runs the su command or executes a SUID program. All of these types of queries are supported by the TB.</P>
<P>You also can use the TB to look for trouble. A second built-in report that Stalker provides is the mail-policy-violation-report. A simple query looks for typical UNIX mail files and finds audit events that show that someone other than the file&#146;s owner tried to access the file. If you think of the audit logs as a relational database table and envision the TB as a query interface into this database, you see that there are a number of important uses.</P>
<P>Stalker looks for attacks against UNIX systems. If you install application software for which Stalker does not include predefined reports or queries, you can design your own queries or reports to track activities against these files. If the application introduces its own subjects, objects, and access control events, Stalker will not report on those activities <I>unless</I> they are added to the audit trail by the application vendor.</P>
<P>Today, Stalker provides only batch or interactive queries. The capability to filter for specific queries in real time would be an added advantage. This feature would introduce some interesting tradeoffs for you as well. Each real-time filter would add load on the network and on a centralized monitor. Configuring a feature like this in a distributed environment would require a few tries to perfect, particularly if you have a very large site. The capability to organize analysis engines into a hierarchy also would be beneficial for <I>any</I> real-time distributed monitoring tool.</P><P><BR></P>
<CENTER>
<TABLE BORDER>
<TR>
<TD><A HREF="227-228.html">Previous</A></TD>
<TD><A HREF="../ewtoc.html">Table of Contents</A></TD>
<TD><A HREF="231-234.html">Next</A></TD>
</TR>
</TABLE>
</CENTER>


<!-- all of the reference materials (books) have the footer and subfoot reveresed -->
<!-- reference_subfoot = footer -->
<!-- reference_footer = subfoot -->

<!-- BEGIN SUB FOOTER -->
		<br><br>
		</TD>
    </TR>
	</TABLE>

		
	<table width="640" border=0 cellpadding=0 cellspacing=0>
		<tr>
		<td align="left" width=135><img src="/images/white.gif" width=100 height="1" alt="" border="0"></td>
		
		
<!-- END SUB FOOTER -->

<!-- all of the books have the footer and subfoot reveresed -->
<!-- reference_subfoot = footer -->
<!-- reference_footer = subfoot -->

<!-- FOOTER -->
			
		<td width="515" align="left" bgcolor="#FFFFFF">
<font face="arial, helvetica" size="1"><b><a href="/products.html"><font color="#006666">Products</font></a>&nbsp;|&nbsp; <a href="/contactus.html"><font color="#006666">Contact Us</font></a>&nbsp;|&nbsp; <a href="/aboutus.html"><font color="#006666">About Us</font></a>&nbsp;|&nbsp; <a href="http://www.earthweb.com/corporate/privacy.html" target="_blank"><font color="#006666">Privacy</font></a> &nbsp;|&nbsp; <a href="http://www.itmarketer.com/" target="_blank"><font color="#006666">Ad Info</font></a> &nbsp;|&nbsp; <a href="/"><font color="#006666">Home</font></a></b>
		<br><br>
		
		Use of this site is subject to certain <a href="/agreement.html">Terms &amp; Conditions</a>, <a href="/copyright.html">Copyright &copy; 1996-1999 EarthWeb Inc.</a><br> 
All rights reserved.  Reproduction whole or in part in any form or medium without express written permision of EarthWeb is prohibited.</font><p>
</td>
		</tr>
</table>
</BODY>
</HTML>

<!-- END FOOTER -->