Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations. Use when deploying OSSEC, Wazuh, or AIDE for endpoint monitoring, building file integrity monitoring (FIM) policies, or meeting compliance requirements for change detection. Activates for requests involving HIDS configuration, file integrity monitoring, OSSEC/Wazuh deployment, or host-based detection.
Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations. Use when deploying OSSEC, Wazuh, or AIDE for endpoint monitoring, building file integrity monitoring (FIM) policies, or meeting compliance requirements for change detection. Activates for requests involving HIDS configuration, file integrity monitoring, OSSEC/Wazuh deployment, or host-based detection.
Monitoring system configuration changes, rootkit detection, and security policy violations
Integrating HIDS alerts with SIEM platforms for centralized monitoring
Do not use this skill for network-based IDS (Suricata, Snort) or for EDR deployment.
Common Misconfigurations & Verification
FIM "realtime" silently downgraded to scheduled:realtime="yes" only works with inotify (Linux) or the USN journal (Windows). On NFS/overlay mounts it falls back to the 12h <frequency> scan — touch a file under a watched /etc path and confirm a 550/554 alert fires within seconds, not hours. For change-who attribution use whodata="yes" (requires auditd).
Agent enrolled but not active:/var/ossec/bin/agent_control -l (or Dashboard → Agents) must show Active, not Never connected/Disconnected. A registered-but-disconnected agent produces zero FIM events while still looking deployed.
Rules present but below the alert threshold: local rules with level < <log_alert_level> never reach the manager/SIEM. Confirm 100001-100003 actually index, not just load.
syscheck/rootcheck disabled by a later block: a second <syscheck><disabled>yes</disabled> in an agent-group config overrides the local one. Grep the merged ossec.conf on the endpoint, not the template.
Verify end-to-end: run an Atomic Red Team test such as T1547.001 (add a Run key) or T1070.004 (unlink a watched file) and confirm the corresponding rule appears in alerts.json and forwards to Splunk/OpenSearch. No alert means a monitoring gap, not a clean host.
Prerequisites
Wazuh server (manager) deployed and accessible from endpoints
Administrative access to target endpoints
Network connectivity: agents to Wazuh manager on port 1514 (TCP/UDP) and 1515 (TCP enrollment)
Wazuh dashboard (OpenSearch Dashboards) for alert visualization
Understanding of critical files/directories to monitor per OS
<!-- Custom rules in /var/ossec/etc/rules/local_rules.xml --><groupname="local,syscheck,"><!-- Alert on critical binary modifications --><ruleid="100001"level="12"><if_sid>550</if_sid><match>/usr/bin/|/usr/sbin/|/bin/|/sbin/</match><description>Critical system binary modified: $(file)</description><group>syscheck,pci_dss_11.5,</group></rule><!-- Alert on new executable in temp directories --><ruleid="100002"level="10"><if_sid>554</if_sid><match>/tmp/|/var/tmp/</match><description>New file created in temp directory: $(file)</description><group>syscheck,malware,</group></rule><!-- Alert on SSH configuration changes --><ruleid="100003"level="10"><if_sid>550</if_sid><match>/etc/ssh/sshd_config</match><description>SSH configuration modified</description><group>syscheck,authentication,</group></rule></group>
Step 5: Configure Active Response
<!-- Auto-block IP after repeated authentication failures --><active-response><command>firewall-drop</command><location>local</location><rules_id>5712</rules_id><timeout>600</timeout></active-response><!-- Disable account after brute force detection --><active-response><disabled>no</disabled><command>disable-account</command><location>local</location><rules_id>100100</rules_id><timeout>3600</timeout></active-response>
Step 6: Integrate with SIEM
# Wazuh to Splunk via Filebeat
# Edit /etc/filebeat/filebeat.yml:
filebeat.inputs:
- type: log
paths:
- /var/ossec/logs/alerts/alerts.json
json.keys_under_root: true
output.elasticsearch:
hosts: ["https://splunk-hec:8088"]
# Wazuh to Elastic via direct integration
# Wazuh indexer feeds directly into OpenSearch/Elasticsearch
# Dashboard: https://wazuh-dashboard:5601
Key Concepts
Term
Definition
HIDS
Host-based Intrusion Detection System; monitors individual endpoints for malicious activity
FIM
File Integrity Monitoring; detects unauthorized changes to files by comparing cryptographic hashes
Syscheck
Wazuh/OSSEC module for file integrity monitoring and registry monitoring
Rootcheck
Wazuh/OSSEC module for rootkit and malware detection
Samhain: Open-source HIDS focused on file integrity and log monitoring
Common Pitfalls
Monitoring too many directories: FIM on entire filesystems generates excessive alerts. Focus on critical system binaries, configuration files, and web roots.
Not excluding noisy files: Frequently changing files (logs, temp, caches) generate false positive FIM alerts. Maintain exclusion lists.
Ignoring baseline establishment: First FIM scan creates a baseline. Changes detected before baseline stabilization are noise, not threats. Allow 48 hours for baseline.
Active response without testing: Auto-blocking IPs or disabling accounts can cause outages. Test active response rules in a non-production environment first.
Agent enrollment failures: Agents must successfully enroll with the manager before monitoring begins. Verify firewall rules allow port 1514 and 1515 traffic.
