What it does
OSSEC is an open-source host-based intrusion detection system with log analysis, file-integrity monitoring, malware detection and active-response capabilities.
OSSEC focuses on events and changes on hosts. File-integrity monitoring can highlight a change to an important path, while log analysis supplies surrounding activity. Define the files and events worth reviewing for a particular server role before expanding coverage. The official site distinguishes base OSSEC from OSSEC+ and the commercial Atomic OSSEC offering. This entry covers the underlying OSSEC family. Active response should follow an explicit policy so a detection leads to a predictable operational action.
Strengths
- Host log and file-integrity monitoring
Best for
- Administrators establishing host intrusion-detection coverage
Sources
- OSSEC - World's Most Widely Used Host Intrusion Detection System - HIDS (Oct 26, 2026)
- OSSEC LICENSE (Oct 26, 2026)