Host-based intrusion detection system comparison

Comparison of Host-based intrusion detection system components and systems.

Free software

As per the Unix philosophy a good HIDS is composed of multiple packages each focusing on a specific aspect.

Package	Year	Ubuntu	CentOS	File	Network	Logs	Config	Sane defaults	Notes
OSSEC	2017	No	No	Yes	Yes	Yes	Yes
Lynis	2017	Partial broken	Yes	No	No	No	Yes	Yes	Compliance testing only in the commercial version
OpenVAS	2017	No	No	No	No	No	Yes
Samhain	2016	Yes	No	Yes	No	Partial		No
Snort	2015	Yes	No	No	Yes	No
chkrootkit	2017	Yes	No	Yes	No	Partial
rkhunter	2014	Yes	Yes	Yes	No	No	Yes	Yes
unhide	2012	Yes	Yes	No	No	No			proc ps compare
Sguil	2017	No	No	No	Yes	No
Logwatch	2017	Yes	Yes	No	No	Yes		No
Logcheck	2017	Yes	Yes	No	No	Yes		No
Epylog	2014	Yes	Yes	No	No	Yes
SWATCH	2015	Yes	Yes	No	No	Yes
sagan	2017	Yes	No	No	No	Yes
aide	2016	Yes	Yes	Yes	No	No		No
tripwire	2013	Yes	Yes	Yes	No	No

Proprietary software

Package	Year	Linux	Windows	File	Network	Logs	Config	Notes
Verisys	2016	Yes	Yes
Nessus	2017	Yes	Yes				Yes

External links

• Debian security manual
• Arch security wiki
• CentOS security wiki
• Ubuntu security wiki