Open-Source Host-Based Intrusion Detection System: OSSEC

ID N0WHERE:28816
Type n0where
Reporter N0where
Modified 2015-04-12T17:34:02


OSSEC is a platform to monitor and control your systems. It mixes together all the aspects of HIDS (host-based intrusion detection), log monitoring, and Security Incident Management (SIM)/Security Information and Event Management (SIEM) together in a simple, powerful, and open source solution.

Key Benefits

Compliance Requirements

OSSEC helps customers meet specific compliance requirements such as PCI and HIPAA. It lets customers detect and alert on unauthorized file system modifications and malicious behavior embedded in the log files of commercial products as well as custom applications. For PCI, it covers the sections of file integrity monitoring (PCI 11.5, 10.5), log inspection and monitoring (section 10), and policy enforcement/checking.

Multi platform

OSSEC lets customers implement a comprehensive host based intrusion detection system with fine grained application/server specific policies across multiple platforms such as Linux, Solaris, Windows, and Mac OS X.

Real-time and Configurable Alerts

OSSEC lets customers configure incidents they want to be alerted on, and lets them focus on raising the priority of critical incidents over the regular noise on any system. Integration with smtp, sms, and syslog allows customers to be on top of alerts by sending them to e-mail enabled devices. Active response options to block an attack immediately are also available.

Integration with current infrastructure

OSSEC will integrate with current investments from customers such as SIM/SEM (Security Incident Management/Security Events Management) products for centralized reporting and correlation of events.

Centralized management

OSSEC provides a simplified centralized management server to manage policies across multiple operating systems. Additionally, it also lets customers define server specific overrides for finer grained policies.

Agent and agentless monitoring

OSSEC offers the flexibility of agent based and agentless monitoring of systems and networking components such as routers and firewalls. Agentless monitoring lets customers who have restrictions on software being installed on systems (such as FDA approved systems or appliances) meet security and compliance needs.

Key Features

File Integrity checking

There is one thing in common to any attack to your networks and computers: they change your systems in some way. The goal of file integrity checking (or FIM – file integrity monitoring) is to detect these changes and alert you when they happen. It can be an attack, or a misuse by an employee or even a typo by an admin, any file, directory or registry change will be alerted to you.

Covers PCI DSS sections 11.5 and 10.5.5.

Log Monitoring

Your operating system wants to speak to you, but do you know how to listen? Every operating system, application, and device on your network generate logs (events) to let you know what is happening. OSSEC collects, analyzes and correlates these logs to let you know if something suspicious is happening (attack, misuse, errors, etc). Do you want to know when an application is installed on your client box? Or when someone changes a rule in your firewall? By monitoring your logs, OSSEC will notify you.

This should cover PCI DSS section 10.

Rootkit detection

Criminal hackers want to hide their actions, but using rootkit detection you can be notified when the system is modified in a way common to rootkits.

Active response

Active response allows OSSEC to take immediate action when specified alerts are triggered. This may prevent an incident from spreading before an administrator can take action.

OSSEC Architecture

OSSEC is composed of multiple pieces. It has a central manager for monitoring and receiving information from agents, syslog, databases, and from agentless devices.

Manager (or Server)

The manager is the central piece of the OSSEC deployment. It stores the file integrity checking databases, the logs, events, and system auditing entries. All the rules, decoders, and major configuration options are stored centrally in the manager; making it easy to administer even a large number of agents.

Agents connect to the server on port 1514/udp. Communication to this port must be allowed for agents to communicate with the server.

Note: The manager may be called the OSSEC server, or even just server in this documentation.


The agent is a small program, or collection of programs, installed on the systems to be monitored. The agent will collect information and forward it to the manager for analysis and correlation. Some information is collected in real time, others periodically. It has a very small memory and CPU footprint by default, not affecting the system’s usage.

_ Agent security _ : It runs with a low privilege user (generally created during the installation) and inside a chroot jail isolated from the system. Most of the agent configuration can be pushed from the manager.

Note: OSSEC can only be installed as an agent on Microsoft Windows platforms. These systems will require an OSSEC server, running on Linux or another unix-like system.


For systems that an agent cannot be installed on, the agentless support may allow integrity checks to be performed. Agentless scans can be used to monitor firewalls, routers, and even Unix systems.


OSSEC allows you to install the agent on the guest operating systems. It may also be installed inside some versions of VMWare ESX, but this may cause support issues. With the agent installed inside VMware ESX you can get alerts about when a VM guest is being installed, removed, started, etc. It also monitors logins, logouts and errors inside the ESX server. In addition to that, OSSEC performs the Center for Internet Security (CIS) checks for VMware, alerting if there is any insecure configuration option enabled or any other issue.

Firewalls, switches and routers

OSSEC can receive and analyze syslog events from a large variety of firewalls, switches and routers. It supports all Cisco routers, Cisco PIX, Cisco FWSM, Cisco ASA, Juniper Routers, Netscreen firewall, Checkpoint and many others.

Supported Systems

OSSEC supports the following operating systems and log formats.

Operating Systems

The following operating systems are supported by the OSSEC agent:

  • GNU/Linux (all distributions, including RHEL, Ubuntu, Slackware, Debian, etc)
  • Windows XP, 2003, Vista, 2008, 2012
  • VMWare ESX 3.0,3.5 (including CIS checks)
  • FreeBSD (all current versions)
  • OpenBSD (all current versions)
  • NetBSD (all current versions)
  • Solaris 2.7, 2.8, 2.9 and 10
  • AIX 5.2 and 5.3
  • Mac OS X 10.x
  • HP-UX 11

Devices supported via Syslog

These systems/devices are also supported via remote syslog:

  • Cisco PIX, ASA and FWSM (all versions)
  • Cisco IOS routers (all versions)
  • Juniper Netscreen (all versions)
  • SonicWall firewall (all versions)
  • Checkpoint firewall (all versions)
  • Cisco IOS IDS/IPS module (all versions)
  • Sourcefire (Snort) IDS/IPS (all versions)
  • Dragon NIDS (all versions)
  • Checkpoint Smart Defense (all versions)
  • McAfee VirusScan Enterprise (v8 and v8.5)
  • Bluecoat proxy (all versions)
  • Cisco VPN concentrators (all versions)
  • VMWare ESXi 4.x

Devices and Operating Systems via Agentless

Using OSSEC agentless options, the following systems are also supported (for log analysis and file integrity checking):

  • Cisco PIX, ASA and FWSM (all versions)
  • Cisco IOS routers (all versions)
  • Juniper Netscreen (all versions)
  • SonicWall firewall (all versions)
  • Checkpoint firewall (all versions)
  • All operating systems specified in the “operating systems” section

Open-Source Host-Based Intrusion Detection System: OSSEC Documentation

Open-Source Host-Based Intrusion Detection System: OSSEC Download