Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Looking for a host-based IDS comparable to tripwire. Preferably one that allows centralized management. Right now I use tripwire and though it works management and reporting through a central server would be ideal. I'm looking for recommendations that have actually been used and not just google results. Thanks!

share

locked by sysadmin1138 Aug 22 '12 at 0:33

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

    
Product and service recommendations are off topic per the updated FAQ. –  sysadmin1138 Aug 22 '12 at 0:33

4 Answers 4

up vote 8 down vote accepted

We use OSSEC as HIDS and Splunk to analyze the results. OSSEC provides:

  • File integrity
  • Log monitoring
  • Rootkit detection
  • Configuration analysis

There is a free Splunk App, called Splunk for OSSEC which works great to manage OSSEC alerts (there are dashboards, queries, etc.). We use free Splunk.

You can also use the OSSEC WebUI, but it is much more limited.

To give you an idea of how it is, have a look at this screenshot.

share
1  
I like tools that do one job and do it well. I'm hesitant to use something with so many features I don't care about. Can I use just the file integrity component? How do you like the WebUI for file integrity? Any issues experienced since your initial answer? Thanks! –  CarpeNoctem Oct 10 '11 at 23:06

OSSec provides an IDS similar to Tripwire, amongst other host monitoring. It's centrally managed, with all the logs arriving into a single collector. If you've got a server to spare then you could also use OSSim which provides IDS as well as network monitoring and penetration testing tools.

share

If you are using Windows systems, a good alternative to Tripwire is Verisys. Like Tripwire it does file integrity monitoring and has a central administration console for reporting etc, but it's a whole lot easier to use than Tripwire. And cheaper :)

It's Windows only though, so not much use if you are using Linux...

share

Give a try to Prelude (http://www.prelude-technologies.com/en/development/community/index.html). I wanted to test it too, it seems much better than normal HIDS.

share

Not the answer you're looking for? Browse other questions tagged or ask your own question.