Skip to main content

Questions tagged [hids]

Questions about Host Based Intrusion Detection Systems

Filter by
Sorted by
Tagged with
3 votes
1 answer
156 views

How to find out what the subnet is that is attacking me

I have a webserver and mailserver that I use for fun/learning/breaking. There is only one user who should be logging in; me. I notice in the postfix logs and HIDS alerts I get a lot of SASL failures ...
Èl Sea's user avatar
  • 57
0 votes
1 answer
453 views

Monitor logs managed by Wazuh and OSSEC

Today I use OSSEC as HIDS, but reading Wazuh's site it seems to be more modern and has more resources. I saw that it has an Elastic Stack integration, something I don't interested about due to using ...
Tom's user avatar
  • 174
0 votes
1 answer
497 views

File Integrity Monitoring via Syslog-ng or agentless - is it possible?

I am involved in a project which deals with PCI-DSS compliance. Particularly, there is a requirement to implement FIM (File Integrity Monitoring) for critical devices. Within these devices, there are ...
Alessandro's user avatar
1 vote
0 answers
212 views

Help in understnading HIDS OSSEC traces

I realized my system Ubuntu and windows dual boot might have been compromised. So, I installed OSSEC HIDS to try to look for issues. When I ran dmesg, i found the following trace: ------------[ cut ...
dawn's user avatar
  • 111
2 votes
1 answer
160 views

Confusion Matrix for Generated Signatures in Snort

How do we come with True Positives and False Negatives rates when creating signatures in IDS? How do we measure the signatures efficiency? I've seen so many papers that discuss the same, but how do ...
Tasneem Singh's user avatar
2 votes
0 answers
495 views

How do I create exceptions on Wazuh (OSSEC)?

I currently have a setup with OSSEC and AIDE running on our servers. We are currently receiving a daily alert for each agent when AIDE runs and changes audit.log. I want to make an exception for ...
Thiago Escobar's user avatar
1 vote
0 answers
569 views

How do use ArcSight ESM to monitor powershell logs? [closed]

I have read mixed reviews, our team within our DoD sector suggest that ingestion the logs directly into the SIEM platform would be best and I feel that having a third party tool with signatures, look ...
md154199's user avatar
0 votes
1 answer
3k views

Does Wazuh have capabilities for handle virus/malware/rootkit ? If yes, How?

This question is similar with this one: OSSEC capabilities for handle a virus that already spread into the deepest system But it didnt roughly answer how could i do that exactly. I have tried Wazuh ...
gagantous's user avatar
  • 193
1 vote
1 answer
2k views

AIDE and OSSEC conflicts?

Being fairly new to both AIDE and OSSEC I've been trying to find out if there are any potential conflicts in having them both installed on one host (CentOS 7.5). It seems like they could work as a ...
jfran3's user avatar
  • 151
0 votes
2 answers
401 views

Can NIDS alone protect the Servers in our network, or we need HIDS application as well?

I have problem with some institute server. The scenario is like below. There is an institute (Government/Corporate/Industry) that have their own dedicated server. But there is no other security ...
gagantous's user avatar
  • 193
1 vote
2 answers
2k views

Combine SNORT detection and log with active response OSSEC

As far as i know, NIDS implemented in Network layer and HIDS in Host-based layer, Is it possible for NIDS( for example: Snort or suricata ) log that will included in HIDS(for example: OSSEC) log too ? ...
gagantous's user avatar
  • 193
1 vote
0 answers
353 views

Identifying privilege escalation in OSSEC logs [closed]

I am working on an intrusion detection system which can prioritize and attribute the logs generated by OSSEC. So, how can I understand a privilege escalation case (or just the privileges a user has at ...
qwerty's user avatar
  • 111
2 votes
2 answers
526 views

Can OSSEC detect buffer overflow attacks?

I am trying to detect buffer overflow by using OSSEC (a HIDS software) as mentioned in OSSEC rules example and OSSEC book. How can I configure OSSEC for detect a simple buffer overflow example as the ...
khant's user avatar
  • 191
1 vote
1 answer
221 views

Escaping Virtualbox type intrusion detection?

Is there a way to run intrusion detection for if anything tries to escape from Virtualbox? Thank you.
Smiith's user avatar
  • 157
14 votes
2 answers
16k views

HIDS - Choosing between regular OSSEC or Wazuh fork

I intend to set up OSSEC and noticed there seem to be two main flavours: plain OSSEC and Wazuh fork. From what I've been able to gather (from Wazuh's website and documentation), the main advantages ...
simoesf's user avatar
  • 143
2 votes
1 answer
2k views

Tap-mode IPS vs IDS

It is my understanding that tap mode IPS, unlike in-line mode, is passive and cannot prevent attacks. In that case, what is the difference between an IDS and a tap mode IPS? I've checked out several ...
George's user avatar
  • 739
3 votes
1 answer
1k views

Silence OSSEC rootcheck alerts

I'm trying to silence some OSSEC rootcheck alerts like these:- ** Alert 1456448991.70239: mail - ossec,rootcheck, 2016 Feb 26 01:09:51 myhost->rootcheck Rule: 519 (level 7) -> 'System Audit: ...
jah's user avatar
  • 420
0 votes
1 answer
1k views

Do I need ossec for my personal home computer? [closed]

Do I really need a HIDS like ossec, or will using good passwords, using a firewall, an antivirus/antimalware program, and a rootkit scanner do the job well enough?
0000's user avatar
  • 13
-1 votes
1 answer
186 views

Host Based IDS with syscall monitoring

Hey Guys I am a newbie in security stuff and now I am working on my final project about host based IDS. I have some questions to you guys Can a rootkit be classified as an intrusion or is it a ...
Ramandika Pranamulia's user avatar
2 votes
0 answers
2k views

USB Rubber Ducky Firmware Upgrade [closed]

I just erased my firmware, using dfu-programmer-0.7.2: $ dfu-programmer at32uc3b1256 erase Checking memory from 0x2000 to 0x3FFFF... Not blank at 0x2001. Erasing flash... Success Checking memory from ...
voices's user avatar
  • 1,789
1 vote
0 answers
526 views

How to test OSSEC HIDS using a linux dataset containing raw system call traces?

I have been tasked to test effectiveness of OSSEC HIDS (by effectiveness I mean detection rate it achieves as well as false positives rate) when a dataset of raw system call traces are used. The ...
FoxEM's user avatar
  • 19
2 votes
1 answer
3k views

Can Snort be configured as HIDS?

I need to give a presentation regarding Snort and Security Auditing. I have recently learned to configure Snort as a NIDS. I want to know is there any way I can configure Snort as an HIDS? If I am ...
Anurag's user avatar
  • 897
6 votes
3 answers
1k views

Which Windows Files Should be Monitored by HIDS?

I highlighted my question below. Here is some background. It's easy to find data showing the most commonly trojaned/modified Linux binaries and config files. ps, ls, find, kill, lsof, passwd, shadow,...
nhdgvst's user avatar
  • 61