Advanced Intrusion Detection Environment: Difference between revisions

Revision as of 13:52, 6 March 2023

Latest revision as of 06:42, 22 September 2023

Line 31:

When the administrator wants to run an integrity test, the administrator places the previously built database in an accessible place and commands AIDE to compare the database against the real status of the system. Should a change have happened to the computer between the snapshot creation and the test, AIDE will detect it and report it to the administrator. Alternatively, AIDE can be configured to run on a schedule and report changes daily using scheduling technologies such as [[cron]], which is the default behavior of the [[Debian]] AIDE package.<ref>{{cite web|title=Using Aide on Ubuntu 12.04 LTS (Precise Pangolin) and Debian 7 (Wheezy)|url=http://www.snekul.com/wordpress/blog/2012/09/27/using-aide-on-ubuntu-12-04-lts-precise-pangolin-and-debian-7-wheezy/|archive-url=https://web.archive.org/web/20130109055116/http://www.snekul.com/wordpress/blog/2012/09/27/using-aide-on-ubuntu-12-04-lts-precise-pangolin-and-debian-7-wheezy/|url-status=dead|archive-date=9 January 2013|accessdate=12 March 2013}}</ref>

This is mainly useful for security purposes, given that any malicious change which could have happened inside of the system would be reported by AIDE.

== See also ==