Comparison of host-based intrusion detection system components and systems.
Free and open-source software As per the Unix philosophy a good HIDS is composed of multiple packages each focusing on a specific aspect. Package Last Update Debian Official Repositories AlmaLinux Official Repositories openSUSE Official Repositories File Network Logs Config Notes OSSEC 2025 OSSEC for Debian Based systems OSSEC for RHEL/Fedora Based systems An Open Source Host-based Intrusion Detection System Wazuh2025 ? Samhain 2025 Samhain in the Ubuntu Repositories File integrity and host-based IDS Last Snort 2025 Snort in the Ubuntu Repositories Snort in the CentOS Repositories chkrootkit 2023 ChkRootkit in the Ubuntu Repositories lastlog, wtmp, utmp, wtmpx rkhunter 2018 RKHunter in the Ubuntu Repositories RKHunter in the CentOS Repositories unhideunhide is notable because it's part of Debian and Fedora 2012 UnHide in the Ubuntu Repositories UnHide in the CentOS Repositories proc ps compare Sguil 2017 Logwatch Logwatch is notable because it's part of Debian and Fedora 2017 LogWatch in the Ubuntu Repositories LogWatch in the CentOS Repositories Logcheck Logcheck is notable because it's part of Debian and Fedora 2017 Logcheck in the Ubuntu Repositories Logcheck in the CentOS Repositories Epylog Epylog is notable because it's part of Debian and Fedora 2014 Epylog in the Ubuntu Repositories Epylog in the CentOS Repositories SWATCH SWATCH is notable because it's part of Debian and Fedora 2015 SWATCH in the Ubuntu Repositories SWATCH in the CentOS Repositories sagan 2021 Sagan in the Ubuntu Repositories aide 2025 AIDE in the Ubuntu Repositories AIDE in the CentOS Repositories yes uses libs for routines tripwire 2018 Tripwire in the Ubuntu Repositories Tripwire in the CentOS Repositories Tiger 2018 Tripwire in the Ubuntu Repositories 3/42 modules are Debian specific.
Proprietary software Package YearLast updated Linux Windows File Network Logs Config Notes Lacework 2018 Verisys 2018 Nessus 2017 Atomicorp2019 Commercially enhanced version of OSSEC Spartan2021 Websocket API, IP to Country mapping, DynDNS Integration
References
External links Debian security manual Arch security wiki CentOS security wiki Ubuntu security wiki