4.1 Input Definitions
The input to the Hummingbird system is the data being analyzed by the tools.
4.1.1 uptime
This command shows how long system has been up, and/or who is logged in and what they are doing.
4.1.2 Load
Load is a measure of how busy a system is.
4.1.3 Number of Users
This data signifies how many users are currently on the system.
4.1.4 Syslog
This is a file that keeps track of system messages.
4.1.5 Maillog
This is a file that keep tracks of incoming and outgoing mail.
4.1.6 Telnets
This data is to keep track of who is telneting in and out of a system.
4.1.7 ftp
This data is to keep track of who is ftp'ing files on a system.
4.1.8 Web page access
This data is to keep track of users accessing web pages.
4.2 Output Definitions
The final output from the Hummingbird system consists of alert messages to user consoles and a database. These are specified by the user.
4.3 Global Data Definitions
The HummingBird system has a number of classes used to define data.
It also uses tables to store the data.
4.3.1 Message Class
The Message class is the internal class of data for messages passed to and from the Server
class Message
{
public:
char Description [256];
char Date[9];
char Time[7];
char Filename[256];
char HostIP[16];
int MessageAge; // This is used to expire messages caught in
a loop.
};
This class is used in TOOLI, and Server.
4.3.2 MessageFilter Class
The MessageFilter class is the internal class of data for message filters.
class MessageFilter
{
public:
char RegExp[256];
char StartDate[7];
char EndDate[7];
char StartTime[7];
char EndTime[7];
char TrustLevel[2];
HostList *FromHostList;
char Log;
char Alert;
HostList *ForwardHostList;
MessageFilter *Next;
MessageFilter *NewNext;
};
4.3.3 Trust Class
The Trust data class is used for trust filtering.
class Trust
{
public:
char StartHostIP[16];
char EndHostIP[16];
char TrustLevel;
Trust *Next;
};
4.3.4 Accept_list Table
This table keep tracks of which hosts filters are accepted from. It contains the following fields:
filter (text, length = variable)
host (text, length = variable)
4.3.5 Config_time Table
This table keeps track of the times of configurations. It has the following field:
time (int4, length = 4)
4.3.6 Filter Table
The filter table keep tracks of what information is to be filtered. It contains the following fields:
expression (text, length = variable)
date_start (date, length = 4)
date_end (date, length = 4)
time_start (time, length = 4)
time_end (time, length = 4)
trust (int4, length = 4)
log (int4, length = 4)
alert (int4, length = 4)
inh (int4, length = 4)
4.3.7 Forward_list Table
This table keeps track of hosts to forward filters to. It contains the following fields:
filter (text, length = variable)
host (text, length = variable)
4.3.8 Forward_peer Table
This table keeps track of the peers to forward filter information to. It contains the following fields:
filter (text, length = variable)
pgroup (text, length = variable)
inh (int4, length = 4)
4.3.9 Kill_file Table
This table keeps track of the hosts in the Kill_file. When information
from the hosts in this file is received it is ignored.
It contains the following fields:
start_addr (text, length = variable)
end_addr (text, length = variable)
inh (int4, length = 4)
4.3.10 Levels Table
This table keeps track of the trust, cooperation, and integrity levels
assigned to hosts. It contains the following fields:
start_addr (text, length = variable)
end_addr (text, length = variable)
trust (int4, length = 4)
coop (int4, length = 4)
integ (int4, length = 4)
inh (int4, length = 4)
4.3.11 Log Table
The log table is a table to keep track of what to log for particular hosts. It contains the following fields:
trust (int4, length = 4)
coop (int4, length = 4)
integ (int4, length = 4)
ldate (date, length = 4)
ltime (time, length = 8)
description (varchar, length = 256)
hostip (varchar, length = 64)
file (varchar, length = 256)
tool (varchar, length = 256)
4.3.12 Manager Table
This table keeps track of the managers. It contains the following field:
manager (text, length = variable)
4.3.13 Message Table
This table keeps track of messages to be sent to peer groups. It contains the following fields:
pgroup (text, length = variable)
mem_addr (text, length = variable)
action (text, length = variable)
rdate (date, length = 4)
rtime (time, length = 8)
status (int4, length = 4)
sdate (date, length = 4)
stime (time, length = 8)
mpublic (int4, length = 4)
4.2.14 Peers Table
This table keeps track of the members of a peer group. It contains the following fields:
pgroup (text, length = variable)
mem_addr (text, length = variable)
peer_sub (int4, length = 4)
peer_mod (int4, length = 4)
4.2.15 Pgroups Table
This table keeps track of the contact for each peer group and moderator. It contains the following fields:
pgroup (text, length = variable)
mod_addr (text, length = variable)
email (text, length = variable)
4.3.16 Pid Table
This table keeps track of machines and their pid's. It contains the following fields:
name (text, length = variable)
pid (int4, length = 4)
4.3.17. Subordinates Table
This table keeps track of the subordinates on a hummer. It has the following fields:
hum_name ((bp)char, length = 50)
subord ((bp)char, length = 50)