ossec/ossec-hids

Health v2 · maintenance only

Adoption not part of the score

5047 stars · 1074 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

OSSEC is an open-source host-based intrusion detection system (HIDS) that combines log analysis, file integrity monitoring, rootkit detection, policy auditing, real-time alerting, and active response. It runs as a manager/agent platform across Unix, Linux, macOS, and Windows systems.

Use cases

• detect intrusions on my servers from log files
• monitor file integrity and get alerted on changes
• check systems for rootkits and malware
• audit systems for compliance with PCI-DSS or NIST 800-53
• centralize security log monitoring across many hosts
• automatically respond to attacks like SSH brute force
• self-hosted SIEM alternative for small teams

When to choose

• you need a free, self-hosted HIDS with manager/agent architecture
• you must meet compliance requirements like PCI-DSS or NIST 800-53
• you want file integrity monitoring, log analysis, and active response in one tool
• you need multi-platform coverage including Windows agents

When to avoid

• you want a modern UI and ML-driven detection out of the box (consider Wazuh or OSSEC+)
• you need network-based intrusion detection rather than host-based
• you prefer a fully managed SaaS security monitoring service

Facets

application · maturity stable

monitoring alerting logging security search-engine security monitoring legal self-hosted windows cross-platform self-hosted cpp c hids intrusion-detection file-integrity-monitoring rootkit-detection log-analysis siem pci-dss active-response policy-monitoring devops linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="ossec/ossec-hids")