McAfee HISCDE-AB-IA Product Guide - Page 129

Note 3, Advanced details, For example, if you have a zone named app_zone whose root is /zones/app

Get McAfee HISCDE-AB-IA - Host Intrusion Prevention PDF manuals and user guides View all McAfee HISCDE-AB-IA manuals
Add to My Manuals
Save this manual to your list of manuals

Page 129 highlights

Appendix A - Writing Custom Signatures and Exceptions Non-Windows custom signatures Note 3 The directive unixfile:link has a different meaning when combined with section files and section source: • Combined with section files, it means that creating a link to the file in the section files is monitored. • Combined with section source, it means that no link can be created with the name as specified in the section source. Note 4 The directive unixfile:rename has a different meaning when combined with section files and section source: • Combined with section files, it means that renaming of the file in the section files is monitored. • Combined with section source, it means that no file can be renamed to the file in the section source. Note 5 By default, all zones are protected by the signature. To restrict protection to a particular zone, add a zone section in the signature and include the name of the zone. For example, if you have a zone named "app_zone" whose root is /zones/app, then the rule: Rule { ... file { Include "/tmp/test.log" } zone { Include "app_zone" } ... } would apply only to the file in the zone "app_zone" and not in the global zone. Note that in this release, web server protection cannot be restricted to a particular zone. Advanced details Some or all of the following parameters appear in the Advanced Details tab of security events for the class UNIX_file. The values of these parameters can help you understand why a signature is triggered. GUI name files source file permission source permission new permission Explanation Names of the file that was accessed or attempted to be accessed. Only applicable when operation is the creation of a symbolic link between files: name of the new link; or when operation is the renaming of a file: new name of the file. Permissions of the file. Only applicable when operation is the creation of a symbolic link between files: permissions of the target file (the file to which the link points). Solaris only. Only applicable when creating a new file or when doing a chmod operation: permissions of the new file. Solaris only. McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5 129

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
Note 3
The directive unixfile:link has a different meaning when combined with section files and section
source:
•
Combined with section files, it means that creating a link to the file in the section files is
monitored.
•
Combined with section source, it means that no link can be created with the name as specified
in the section source.
Note 4
The directive unixfile:rename has a different meaning when combined with section files and
section source:
•
Combined with section files, it means that renaming of the file in the section files is monitored.
•
Combined with section source, it means that no file can be renamed to the file in the section
source.
Note 5
By default, all zones are protected by the signature. To restrict protection to a particular zone,
add a zone section in the signature and include the name of the zone.
For example, if you have a zone named "app_zone" whose root is /zones/app, then the rule:
Rule {
...
file { Include "/tmp/test.log" }
zone { Include "app_zone" }
... }
would apply only to the file in the zone "app_zone" and not in the global zone.
Note that in this release, web server protection cannot be restricted to a particular zone.
Advanced details
Some or all of the following parameters appear in the Advanced Details tab of security events
for the class UNIX_file. The values of these parameters can help you understand why a signature
is triggered.
Explanation
GUI name
Names of the file that was accessed or attempted to be
accessed.
files
Only applicable when operation is the creation of a
symbolic link between files: name of the new link; or when
operation is the renaming of a file: new name of the file.
source
Permissions of the file.
file permission
Only applicable when operation is the creation of a
symbolic link between files: permissions of the target file
(the file to which the link points). Solaris only.
source permission
Only applicable when creating a new file or when doing a
chmod operation: permissions of the new file. Solaris only.
new permission
Appendix A — Writing Custom Signatures and Exceptions
Non-Windows custom signatures
129
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5