Host-based intrusion detection system comparison

Comparison of host-based intrusion detection system components and systems.

Free and Open Source software

As per the Unix philosophy a good HIDS is composed of multiple packages each focusing on a specific aspect.

Package	Updated	Ubuntu	CentOS	File	Network	Logs	Config	Sane defaults	Notes
OSSEC	2019	Yes	Yes	Yes	Yes	Yes	Yes
Samhain	2016	Yes	No	Yes	No	Partial		No
Snort	2018	Yes	Yes	No	Yes	No
chkrootkit	2017	Yes	No	Yes	No	Partial
rkhunter	2018	Yes	Yes	Yes	No	No	Yes	Yes	Ubuntu 18.04 LTS has some problems.
unhide	2012	Yes	Yes	No	No	No			proc ps compare
Sguil	2017	No	No	No	Yes	No
Logwatch	2017	Yes	Yes	No	No	Yes		No
Logcheck	2017	Yes	Yes	No	No	Yes		No
Epylog	2014	Yes	Yes	No	No	Yes
SWATCH	2015	Yes	Yes	No	No	Yes
sagan	2018	Yes	No	No	No	Yes
aide	2019	Yes	Yes	Yes	No	No		No
tripwire	2018	Yes	Yes	Yes	No	No

Proprietary software

Package	Year	Linux	Windows	File	Network	Logs	Config	Notes
Lacework	2018	Yes	No	Yes	Yes	Yes	Yes
Verisys	2018	Yes	Yes	Yes	Yes		Yes
Nessus	2017	Yes	Yes				Yes

External links

• Debian security manual
• Arch security wiki
• CentOS security wiki
• Ubuntu security wiki