Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations. Use when deploying OSSEC, Wazuh, or AIDE for endpoint monitoring, building file integrity monitoring (FIM) policies, or meeting compliance requirements for change detection. Activates for requests involving HIDS configuration, file integrity monitoring, OSSEC/Wazuh deployment, or host-based detection.
Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations. Use when deploying OSSEC, Wazuh, or AIDE for endpoint monitoring, building file integrity monitoring (FIM) policies, or meeting compliance requirements for change detection. Activates for requests involving HIDS configuration, file integrity monitoring, OSSEC/Wazuh deployment, or host-based detection.
<!-- Custom rules in /var/ossec/etc/rules/local_rules.xml --><groupname="local,syscheck,"><!-- Alert on critical binary modifications --><ruleid="100001"level="12"><if_sid>550</if_sid><match>/usr/bin/|/usr/sbin/|/bin/|/sbin/</match><description>Critical system binary modified: $(file)</description><group>syscheck,pci_dss_11.5,</group></rule><!-- Alert on new executable in temp directories --><ruleid="100002"level="10"><if_sid>554</if_sid><match>/tmp/|/var/tmp/</match><description>New file created in temp directory: $(file)</description><group>syscheck,malware,</group></rule><!-- Alert on SSH configuration changes --><ruleid="100003"level="10"><if_sid>550</if_sid><match>/etc/ssh/sshd_config</match><description>SSH configuration modified</description><group>syscheck,authentication,</group></rule></group>
Step 5: Configure Active Response
<!-- Auto-block IP after repeated authentication failures --><active-response><command>firewall-drop</command><location>local</location><rules_id>5712</rules_id><timeout>600</timeout></active-response><!-- Disable account after brute force detection --><active-response><disabled>no</disabled><command>disable-account</command><location>local</location><rules_id>100100</rules_id><timeout>3600</timeout></active-response>
Step 6: Integrate with SIEM
# Wazuh to Splunk via Filebeat
# Edit /etc/filebeat/filebeat.yml:
filebeat.inputs:
- type: log
paths:
- /var/ossec/logs/alerts/alerts.json
json.keys_under_root: true
output.elasticsearch:
hosts: ["https://splunk-hec:8088"]
# Wazuh to Elastic via direct integration
# Wazuh indexer feeds directly into OpenSearch/Elasticsearch
# Dashboard: https://wazuh-dashboard:5601
Key Concepts
Term
Definition
HIDS
Host-based Intrusion Detection System; monitors individual endpoints for malicious activity
FIM
File Integrity Monitoring; detects unauthorized changes to files by comparing cryptographic hashes
Syscheck
Wazuh/OSSEC module for file integrity monitoring and registry monitoring
Rootcheck
Wazuh/OSSEC module for rootkit and malware detection
Samhain: Open-source HIDS focused on file integrity and log monitoring
Common Pitfalls
Monitoring too many directories: FIM on entire filesystems generates excessive alerts. Focus on critical system binaries, configuration files, and web roots.
Not excluding noisy files: Frequently changing files (logs, temp, caches) generate false positive FIM alerts. Maintain exclusion lists.
Ignoring baseline establishment: First FIM scan creates a baseline. Changes detected before baseline stabilization are noise, not threats. Allow 48 hours for baseline.
Active response without testing: Auto-blocking IPs or disabling accounts can cause outages. Test active response rules in a non-production environment first.
Agent enrollment failures: Agents must successfully enroll with the manager before monitoring begins. Verify firewall rules allow port 1514 and 1515 traffic.
