I need to deploy some file integrity monitoring and intrusion detections software on AWS instances.

I really wanted to use OSSEC, however it does not work well in an environment where servers can auto deploy and shut down based on load, because it requires server managed keys to be generated. Including the agent in the AMI will not allow monitoring as soon as it comes up because of that.

There are many options out there, and several are listed in other posts on this site, however none that I've seen so far deal with the unique problems inherent in AWS or cloud based deployments in general.

Can anyone point me at some products, preferably open source, that we might use to cover those portions of PCI DSS that require this software?

Has anyone else achieved this on AWS?


I think you can still use OSSEC. A while back i found a blog that seems to indicate that you can at least automate it with puppet, which would mean you could probably create a lot of excess keys, then just assign them as needed possibly.


  • Thanks, I'll take a look. I think there is a hole in the market for Cloud based auto-magically provisioning systems. – Brill Pappin Apr 24 '12 at 13:48
  • Actually, I'm going you the answer since your the only one to respond in a week, and there likely isn't a god answer for the question :) – Brill Pappin Apr 24 '12 at 13:49
  • I wish ossec could be deployed to a host name, or at least an IP pool, it would be handy to use on a couple of client machines. Though. where there's a will, there's always a way to script it :) – Steve Butler Apr 25 '12 at 5:41
  • The link is dead. – hannson Nov 22 '13 at 23:05

There is an option to move to PKI instead of symmetric encryption with the ossec-authd. http://dcid.me/blog/2011/01/automatically-creating-and-setting-up-the-agent-keys/

This would make additions of auto spawned agents (scale out) to the server very easy. But removal of agents upon scale-in is the hard part. https://groups.google.com/forum/#!msg/ossec-list/cpoopmzBf3Q/JZObqvgAFi4J

One idea suggested on the above link is to have a monkey to clean up dead instances from the server periodically by querying AWS. That would work because once an instance dies as a result of scale-in, it will begin to fail the OSSEC server's keep-alive signals. So the monkey could detect inactive agents then check AWS to see if the instance is terminated and remove it from the OSSEC server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.