OSSEC

Definition

OSSEC is an open-source host-based intrusion detection system that monitors log files, system configuration, and file integrity on individual servers and endpoints to detect signs of compromise or unauthorized change. It runs as an agent on monitored hosts reporting to a central manager, which applies rules to incoming data and generates alerts, making it one of the earliest and most widely deployed free intrusion detection tools in production environments.

Overview

Before centralized security monitoring platforms became common, administrators needed a way to detect tampering and suspicious activity on individual servers without paying for commercial host intrusion detection products. OSSEC emerged to fill that role: a free, open-source agent that watches a host's logs and files for signs of compromise and reports findings centrally, giving smaller organizations the same category of protection larger enterprises paid for. Mechanically, an OSSEC agent installed on a monitored host performs log analysis by parsing system and application logs against a library of decoders and rules, file integrity monitoring by taking periodic checksums of critical files and alerting on unexpected changes, and rootkit detection by scanning for known indicators of a compromised system. Agents forward this data to a central OSSEC manager, which correlates events across the fleet and triggers alerts, active responses such as blocking an IP address, or simply logs findings for later review. OSSEC is host-based, meaning it observes activity from inside the operating system it monitors, which distinguishes it from network-based intrusion detection systems like Snort or Suricata that inspect network traffic instead. It differs from a full SIEM in scope: OSSEC focuses specifically on host-level detection and integrity monitoring rather than broad log aggregation, correlation across many data source types, and case management, though it is often paired with a SIEM or forwarded into one for that purpose. Its rule engine is comparatively lightweight next to a modern platform, which historically made it attractive for resource-constrained servers where running a heavier agent was not practical. In practice, system administrators deploy OSSEC agents on servers to detect unauthorized configuration changes, brute-force login attempts, and signs of rootkit installation, using its centralized manager to get fleet-wide visibility without needing a commercial product. OSSEC is also the project that Wazuh forked from, and Wazuh has since expanded significantly beyond what the original OSSEC codebase provides, including vulnerability scanning and cloud monitoring. The main limitations are that OSSEC's development and rule set updates have slowed relative to its more actively developed fork, and it lacks the vulnerability detection, compliance mapping, and modern dashboard interface that newer platforms provide out of the box. Teams choosing between OSSEC and Wazuh today generally lean toward Wazuh unless they specifically need OSSEC's smaller footprint or already have infrastructure built around it. New deployments starting from scratch have little reason to pick OSSEC over its more capable descendant, and OSSEC today mainly persists in environments that adopted it years ago and have not yet migrated.

Key Features

• Performs host-based log analysis using a rule and decoder engine
• Monitors file integrity for unauthorized changes to critical files
• Detects rootkits and other host-level compromise indicators
• Runs as a lightweight agent reporting to a central manager
• Supports active response actions like blocking an offending IP
• Free and open source with a long production track record
• Serves as the original codebase that Wazuh later forked
• Correlates alerts centrally across a fleet of monitored hosts

Use Cases

Alternatives

Frequently Asked Questions

Related in Cybersecurity