OSSEC is an a free and open-source host-based Intrusion Detection System that allows you to perform log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
OSSEC can be run on most operating systems, including Linux, MacOS, Solaris, HP-UX, AIX and Windows.
OSSEC is a complete platform that monitors and controls your systems. OSSEC has all the aspects of HIDS (host-based intrusion detection), log monitoring and SIM/SIEM together in a simple, powerful and open source solution.
OSSEC is cross-platform and it works on Mac OS X, Windows and Linux.
Detailed instructions on how to install and use the OSSEC utility on your Mac are available HERE.
Here are some key features of "OSSEC":
File Integrity checking:
· There is one thing in common to any attack to your networks and computers: they change your systems in some way. The goal of file integrity checking (or FIM – file integrity monitoring) is to detect these changes and alert you when they happen. It can be an attack, or a misuse by an employee or even a typo by an admin, any file, directory or registry change will be alerted to you.
· Covers PCI DSS sections 11.5 and 10.5.5.
Log Monitoring:
· Your operating system wants to speak to you, but do you know how to listen? Every operating system, application, and device on your network generate logs (events) to let you know what is happening. OSSEC collects, analyzes and correlates these logs to let you know if something wrong is going on (attack, misuse, errors, etc). Do you want to know when an application is installed on your client box? Or when someone changes a rule in your firewall? By monitoring your logs, OSSEC will let you know of that.
· Covers PCI DSS section 10 in a whole.
Rootkit detection:
· Criminals (also known as hackers) want to hide their actions, but using rootkit detection you can be notified when they (or trojans, viruses, etc) change your system in this way.
Active response:
· Take immediate and automatic responses when something happens. Why wait for hours when you can alert your admin and block an attack right way?
What's New in This Release: [ read full changelog ]
Installation:
· Add hybrid mode – allows the same host to be both a server and an agent, useful for multi-tier OSSEC deployment.
· Add manage_agents -f option for bulk generation of client keys from an input file.
· During Agent installation, allow the OSSEC server to be specified using hostname instead of IP.
Syscheck:
· Add prelinking support – reduce confusion when a file change is the result of prelinking.
Rootcheck:
· Add fine-grained configuration control – allows you to turn ON/OFF individual rootcheck tasks for more efficiency and flexibility. The default is all ON.
Log monitoring/analysis:
· Add GeoIP lookup support – allows geographical city names to be associated with IP addresses in OSSEC alerts, for more intelligent correlation.
Alert options anslog output:
· Adscheck MD5/SHA1 sum to alerts for easier integration with third-party file signature checking.
· Support JSON and Splunk formats in syslog output.
Rules and other notable changesfixes:
· Windows 2000 logs support has been dep...
Find us on Google+
