Atomic Protector HIDS Configuration

Introduction

AP includes a powerful Host Based Intrusion Detection System (HIDS). This HIDS will look for suspicious activity, suspicious processes, malicious files and other signs of malicious and supsicious activiy. It will also aggregate the systems logs and look for signs of attack, authentication failures, errors in applications, and other important information.

Configuring AP HIDS

You can access the HIDS configuration options by following this process:

Step 1: Log into the AP GUI

Step 2: Click on the ‘Settings’ tab

Step 3: Select ‘AP Configuration’

Step 4: Select ‘Host Intrusion Detection System’

Editing AP HIDS Rules

You can edit specific HIDS rules by following this process:

Step 1: Log into the AP GUI

Step 2: Click on the ‘AP’ tab

Step 3: Select ‘WAF and HIDS Rules’

Step 4: Select ‘HIDS’

Suspicious Behavior Rules

By default, AP comes with a powerful set of rules that should detect and stop most attacks, without generating false positives. AP also includes additional rules that are enabled, but are set to a lower priority and will not automatically block the activities they detect. AP will only alert on these events, it will not take an active response actions.

To change this behavior you can search for rules with an alert level below 5. Level 5 is the default level to block an action (AP will automatically block the action from succeeding and will, if configured to do so, shun the IP address).

Reconfiguring HIDS Rules

To reconfigure a rule simply pull up the rule manager and type in the Rule ID into the search field. For Example:

Step 1: Log into the AP GUI

Step 2: Click on the ‘Configuration’ tab

Step 3: Select ‘Rule Management’

This will bring up the Rule Managment window.

Step 4: Select the ‘Rules’ tab

Step 5: Type in the Rule ID, for example 60815

Step 6: Click on the down arrow next to the Rule ID, this will pull up all the options for the rule. Please see the example below:

Step 7: Select the Active Response drop down and change it to “yes”

Step 8 (Optional, but recommended): We also recommend you change the alert level to 10, that way it will both show up in the AP GUI and you will get an email alerting you when its been activated. If you do not want to be emailed or alerted, just leave the level at 4. You can also select Email and Logging options should you prefer that you be emailed but not notified in the GUI and/or vice versa.