Hosted Based Intrusion Detection System (HIDS) is a system that monitors the host for any suspicious activity going on within them.
OSSEC is one of the most well-known open source HIDS that is available and commonly used in many critical environments. Its powerful features, ease of use, and open source in nature make it one of the top tools of choice for organizations.
Let's explore some of the great features that OSSEC offers:
- Log analysis
- File integrity monitoring
- Rootkit detection
- Active response
Let's look into the basic architecture of OSSEC:
In the preceding diagram, we have an OSSEC Server on the central workstations and each of the other servers have OSSEC Agents installed. Whenever there is an alert, the OSSEC Agents forward them to the central server, and the Security Engineer can monitor the logs from the workstation...
