Host-based intrusion detection system comparison

Comparison of host-based intrusion detection system components and systems.

## Contents

* 1 Free and open-source software
* 2 Proprietary software
* 3 References
* 4 External links

## Free and open-source software

As per the Unix philosophy a good HIDS is composed of multiple packages each focusing on a specific aspect.

Package  | Last Update  | Debian Official Repositories | AlmaLinux Official Repositories | openSUSE Official Repositories | File  | Network  | Logs  | Config | Notes

|
|
|
|
|
|
|
|
|

OSSEC | 2025  | No[1] | No[2] | Yes[3] | Yes  | Yes  | Yes  | Yes  |
Wazuh  | 2025[4] | No  | No  | ?  | Yes  | Yes  | Yes  | Yes  |
Samhain | 2023  | Yes[5] | No  | Yes[6] | Yes  | No  | Partial[7] |  |
Snort | 2025[8] | Yes[9] | No[10] | No  | No  | Yes  | No  |  |
chkrootkit | 2023  | Yes[11] | No  | Yes  | Yes  | No  | Partial[12] |  |
rkhunter | 2018  | Yes[13] | Yes[14] | Yes  | Yes  | No  | No  | Yes  |
unhide[15] | 2012  | Yes[16] | Yes[17] | Yes  | No  | No  | No  |  | proc ps compare
Sguil | 2017  | No  | No  | No  | No  | Yes  | No  |  |
Logwatch[18] | 2017  | Yes[19] | Yes[20] | Yes  | No  | No  | Yes  |  |
Logcheck[21] | 2017  | Yes[22] | Yes[23] | Yes  | No  | No  | Yes  |  |
Epylog[24] | 2014  | Yes[25] | Yes[26] | Yes  | No  | No  | Yes  |  |
SWATCH[27] | 2015  | Yes[28] | Yes[29] | Yes  | No  | No  | Yes  |  |
sagan | 2021  | Yes[30] | No  | No  | No  | No  | Yes  |  |
aide | 2025  | Yes[31] | Yes[32] | Yes  | Yes  | No  | No  | yes  | uses libs for routines
tripwire | 2018  | Yes[33] | Yes[34] | Yes  | Yes  | No  | No  |  |
Tiger | 2018  | Yes[35] | No  | No  | Yes  | No  | No  | Yes  | 3/42 modules are Debian specific.

## Proprietary software

Package  | Year[36] | Linux  | Windows  | File  | Network  | Logs  | Config  | Notes

|
|
|
|
|
|
|
|

Lacework | 2018  | Yes  | No  | Yes  | Yes  | Yes  | Yes  |
Verisys  | 2018  | Yes  | Yes  | Yes  | Yes  |  | Yes  |
Nessus | 2017  | Yes  | Yes  |  |  |  | Yes  |
Atomicorp | 2019  | Yes  | Yes  | Yes  | Yes  | Yes  | Yes  | Commercially enhanced version of OSSEC
Spartan | 2021  | No  | Yes  | Yes  | Yes  | Yes  | Yes  | Websocket API, IP to Country mapping, DynDNS Integration

## References

1. ↑ "Downloads OSSEC". OSSEC. https://ossec.github.io/downloads.html#apt-automated-installation-on-ubuntu-and-debian. Retrieved 2017-10-19. OSSEC for Debian Based systems
2. ↑ "Downloads OSSEC". OSSEC. https://ossec.github.io/downloads.html#rhel-centos-fedora-and-others. Retrieved 2017-10-29. OSSEC for RHEL/Fedora Based systems
3. ↑ "ossec-hids". openSUSE OBS. https://software.opensuse.org/package/ossec-hids. Retrieved 2024-08-11. An Open Source Host-based Intrusion Detection System
4. ↑ "Wazuh documentation Release notes". https://documentation.wazuh.com/current/release-notes/index.html. Retrieved 2025-07-16.
5. ↑ "Samhain". Ubuntu. http://packages.ubuntu.com/search?keywords=samhain. Retrieved 2017-04-19. Samhain in the Ubuntu Repositories
6. ↑ "Samhain". openSUSE OBS. https://software.opensuse.org/package/samhain?search_term=Samhain. Retrieved 2024-08-11. File integrity and host-based IDS
7. ↑ Last
8. ↑ "snort3/snort3 Releases". https://github.com/snort3/snort3/releases. Retrieved 2025-07-16.
9. ↑ "Snort". Ubuntu. http://packages.ubuntu.com/search?keywords=snort. Retrieved 2017-04-19. Snort in the Ubuntu Repositories
10. ↑ "Snort". Cisco Systems. https://pkgs.org/download/snort. Retrieved 2017-05-31. Snort in the CentOS Repositories
11. ↑ "ChkRootkit". Ubuntu. http://packages.ubuntu.com/search?keywords=chkrootkit. Retrieved 2017-04-19. ChkRootkit in the Ubuntu Repositories
12. ↑ lastlog, wtmp, utmp, wtmpx
13. ↑ "RKHunter". Ubuntu. http://packages.ubuntu.com/search?keywords=rkhunter. Retrieved 2017-04-19. RKHunter in the Ubuntu Repositories
14. ↑ "RKHunter". Ubuntu. https://pkgs.org/download/rkhunter. Retrieved 2017-04-19. RKHunter in the CentOS Repositories
15. ↑ "unhide". debian. https://packages.debian.org/search?keywords=unhide. Retrieved 2017-04-17. unhide is notable because it's part of Debian and Fedora
16. ↑ "UnHide". Ubuntu. http://packages.ubuntu.com/search?keywords=unhide. Retrieved 2017-04-19. UnHide in the Ubuntu Repositories
17. ↑ "UnHide". Ubuntu. https://pkgs.org/download/unhide. Retrieved 2017-04-19. UnHide in the CentOS Repositories
18. ↑ "Logwatch". debian. https://packages.debian.org/search?keywords=logwatch. Retrieved 2017-04-17. Logwatch is notable because it's part of Debian and Fedora
19. ↑ "LogWatch". Ubuntu. http://packages.ubuntu.com/search?keywords=logwatch. Retrieved 2017-04-19. LogWatch in the Ubuntu Repositories
20. ↑ "LogWatch". Ubuntu. https://pkgs.org/download/logwatch. Retrieved 2017-04-19. LogWatch in the CentOS Repositories
21. ↑ "Logcheck". debian. https://packages.debian.org/search?keywords=logcheck. Retrieved 2017-04-17. Logcheck is notable because it's part of Debian and Fedora
22. ↑ "Logcheck". Ubuntu. http://packages.ubuntu.com/search?keywords=logcheck. Retrieved 2017-04-19. Logcheck in the Ubuntu Repositories
23. ↑ "Logcheck". Ubuntu. https://pkgs.org/download/logcheck. Retrieved 2017-04-19. Logcheck in the CentOS Repositories
24. ↑ "Epylog". debian. https://packages.debian.org/search?keywords=epylog. Retrieved 2017-04-17. Epylog is notable because it's part of Debian and Fedora
25. ↑ "Epylog". Ubuntu. http://packages.ubuntu.com/search?keywords=epylog. Retrieved 2017-04-19. Epylog in the Ubuntu Repositories
26. ↑ "Epylog". Ubuntu. https://pkgs.org/download/epylog. Retrieved 2017-04-19. Epylog in the CentOS Repositories
27. ↑ "SWATCH". debian. https://packages.debian.org/search?keywords=swatch. Retrieved 2017-04-17. SWATCH is notable because it's part of Debian and Fedora
28. ↑ "SWATCH". Ubuntu. http://packages.ubuntu.com/search?keywords=swatch. Retrieved 2017-04-19. SWATCH in the Ubuntu Repositories
29. ↑ "SWATCH". Ubuntu. https://pkgs.org/download/swatch. Retrieved 2017-04-19. SWATCH in the CentOS Repositories
30. ↑ "Sagan". Ubuntu. http://packages.ubuntu.com/search?keywords=sagan. Retrieved 2017-04-19. Sagan in the Ubuntu Repositories
31. ↑ "AIDE". Ubuntu. http://packages.ubuntu.com/search?keywords=aide. Retrieved 2017-04-19. AIDE in the Ubuntu Repositories
32. ↑ "AIDE". Ubuntu. https://pkgs.org/download/aide. Retrieved 2017-04-19. AIDE in the CentOS Repositories
33. ↑ "Tripwire". Ubuntu. http://packages.ubuntu.com/search?keywords=tripwire. Retrieved 2017-04-19. Tripwire in the Ubuntu Repositories
34. ↑ "Tripwire". Ubuntu. https://pkgs.org/download/tripwire. Retrieved 2017-04-19. Tripwire in the CentOS Repositories
35. ↑ "Tripwire". Ubuntu. http://packages.ubuntu.com/search?keywords=tiger. Retrieved 2017-04-19. Tripwire in the Ubuntu Repositories
36. ↑ Last updated

## External links

* Debian security manual
* Arch security wiki
* CentOS security wiki
* Ubuntu security wiki

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Host-based intrusion detection system comparison. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Host-based_intrusion_detection_system_comparison&oldid=3988814"