Article · Wikipedia archive · Last revised Jul 30, 2026

Host-based intrusion detection system comparison

Comparison of host-based intrusion detection system components and systems.

Last revised
Jul 30, 2026
Read time
≈ 3 min
Length
597 w
Citations
36
Source
Wikipedia ↗

Comparison of host-based intrusion detection system components and systems.

Free and open-source software

As per the Unix philosophy a good HIDS is composed of multiple packages each focusing on a specific aspect.

Package Last Update Debian Official Repositories AlmaLinux Official Repositories openSUSE Official Repositories File Network Logs Config Notes
OSSEC 2025 No1 No2 Yes3 Yes Yes Yes Yes
Wazuh 20254 No No ? Yes Yes Yes Yes
Samhain 2025 Yes5 No Yes6 Yes No Partial7
Snort 20258 Yes9 No10 No No Yes No
chkrootkit 2023 Yes11 No Yes Yes No Partial12
rkhunter 2018 Yes13 Yes14 Yes Yes No No Yes
unhide15 2012 Yes16 Yes17 Yes No No No proc ps compare
Sguil 2017 No No No No Yes No
Logwatch18 2017 Yes19 Yes20 Yes No No Yes
Logcheck21 2017 Yes22 Yes23 Yes No No Yes
Epylog24 2014 Yes25 Yes26 Yes No No Yes
SWATCH27 2015 Yes28 Yes29 Yes No No Yes
sagan 2021 Yes30 No No No No Yes
aide 2025 Yes31 Yes32 Yes Yes No No yes uses libs for routines
tripwire 2018 Yes33 Yes34 Yes Yes No No
Tiger 2018 Yes35 No No Yes No No Yes 3/42 modules are Debian specific.

Proprietary software

Package Year36 Linux Windows File Network Logs Config Notes
Lacework 2018 Yes No Yes Yes Yes Yes
Verisys 2018 Yes Yes Yes Yes Yes
Nessus 2017 Yes Yes Yes
Atomicorp 2019 Yes Yes Yes Yes Yes Yes Commercially enhanced version of OSSEC
Spartan 2021 No Yes Yes Yes Yes Yes Websocket API, IP to Country mapping, DynDNS Integration
References

References

  1. "Downloads OSSEC". OSSEC. Retrieved 2017-10-19. OSSEC for Debian Based systems
  2. "Downloads OSSEC". OSSEC. Retrieved 2017-10-29. OSSEC for RHEL/Fedora Based systems
  3. "ossec-hids". openSUSE OBS. Retrieved 2024-08-11. An Open Source Host-based Intrusion Detection System
  4. "Wazuh documentation Release notes". Retrieved 2025-07-16.
  5. "Samhain". Ubuntu. Retrieved 2017-04-19. Samhain in the Ubuntu Repositories
  6. "Samhain". openSUSE OBS. Retrieved 2024-08-11. File integrity and host-based IDS
  7. Last
  8. "snort3/snort3 Releases". Retrieved 2025-07-16.
  9. "Snort". Ubuntu. Retrieved 2017-04-19. Snort in the Ubuntu Repositories
  10. "Snort". Cisco Systems. Retrieved 2017-05-31. Snort in the CentOS Repositories
  11. "ChkRootkit". Ubuntu. Retrieved 2017-04-19. ChkRootkit in the Ubuntu Repositories
  12. lastlog, wtmp, utmp, wtmpx
  13. "RKHunter". Ubuntu. Retrieved 2017-04-19. RKHunter in the Ubuntu Repositories
  14. "RKHunter". Ubuntu. Retrieved 2017-04-19. RKHunter in the CentOS Repositories
  15. "unhide". debian. Retrieved 2017-04-17.unhide is notable because it's part of Debian and Fedora
  16. "UnHide". Ubuntu. Retrieved 2017-04-19. UnHide in the Ubuntu Repositories
  17. "UnHide". Ubuntu. Retrieved 2017-04-19. UnHide in the CentOS Repositories
  18. "Logwatch". debian. Retrieved 2017-04-17. Logwatch is notable because it's part of Debian and Fedora
  19. "LogWatch". Ubuntu. Retrieved 2017-04-19. LogWatch in the Ubuntu Repositories
  20. "LogWatch". Ubuntu. Retrieved 2017-04-19. LogWatch in the CentOS Repositories
  21. "Logcheck". debian. Retrieved 2017-04-17. Logcheck is notable because it's part of Debian and Fedora
  22. "Logcheck". Ubuntu. Retrieved 2017-04-19. Logcheck in the Ubuntu Repositories
  23. "Logcheck". Ubuntu. Retrieved 2017-04-19. Logcheck in the CentOS Repositories
  24. "Epylog". debian. Retrieved 2017-04-17. Epylog is notable because it's part of Debian and Fedora
  25. "Epylog". Ubuntu. Retrieved 2017-04-19. Epylog in the Ubuntu Repositories
  26. "Epylog". Ubuntu. Retrieved 2017-04-19. Epylog in the CentOS Repositories
  27. "SWATCH". debian. Retrieved 2017-04-17. SWATCH is notable because it's part of Debian and Fedora
  28. "SWATCH". Ubuntu. Retrieved 2017-04-19. SWATCH in the Ubuntu Repositories
  29. "SWATCH". Ubuntu. Retrieved 2017-04-19. SWATCH in the CentOS Repositories
  30. "Sagan". Ubuntu. Retrieved 2017-04-19. Sagan in the Ubuntu Repositories
  31. "AIDE". Ubuntu. Retrieved 2017-04-19. AIDE in the Ubuntu Repositories
  32. "AIDE". Ubuntu. Retrieved 2017-04-19. AIDE in the CentOS Repositories
  33. "Tripwire". Ubuntu. Retrieved 2017-04-19. Tripwire in the Ubuntu Repositories
  34. "Tripwire". Ubuntu. Retrieved 2017-04-19. Tripwire in the CentOS Repositories
  35. "Tripwire". Ubuntu. Retrieved 2017-04-19. Tripwire in the Ubuntu Repositories
  36. Last updated
External links