Violations such as attempted logins, unauthorized access to files, illegal setuid pro- grams, and unauthorized audit modifications are automatically detected and acted upon. This frees the system or security manager to tackle more important end-user problems.
Most security breaches involve a series of actions.
Instead of look- ing at each action individually, ID for SunOS looks at the whole picture. Using a case method modeled after criminal investigations, ID assigns an agent to monitor the suspect and file evidence to the case. By analyzing each security event within the context of a case, ID can distinguish between real threats and innocent behavior. So ID won't kick legitimate users off the system or trigger false alarms. For additional information on available licenses, services, and media, refer to the appropriate price book.