Host-based intrusion detection system comparison
From Wikipedia, the free encyclopedia
Comparison of host-based intrusion detection system components and systems.
Free and open-source software
As per the Unix philosophy a good HIDS is composed of multiple packages each focusing on a specific aspect.
| Package | Last Update | Debian Official Repositories | AlmaLinux Official Repositories | openSUSE Official Repositories | File | Network | Logs | Config | Notes |
|---|---|---|---|---|---|---|---|---|---|
| OSSEC | 2025 | No[1] | No[2] | Yes[3] | Yes | Yes | Yes | Yes | |
| Wazuh | 2025[4] | No | No | ? | Yes | Yes | Yes | Yes | |
| Samhain | 2025 | Yes[5] | No | Yes[6] | Yes | No | Partial[7] | ||
| Snort | 2025[8] | Yes[9] | No[10] | No | No | Yes | No | ||
| chkrootkit | 2023 | Yes[11] | No | Yes | Yes | No | Partial[12] | ||
| rkhunter | 2018 | Yes[13] | Yes[14] | Yes | Yes | No | No | Yes | |
| unhide[15] | 2012 | Yes[16] | Yes[17] | Yes | No | No | No | proc ps compare | |
| Sguil | 2017 | No | No | No | No | Yes | No | ||
| Logwatch[18] | 2017 | Yes[19] | Yes[20] | Yes | No | No | Yes | ||
| Logcheck[21] | 2017 | Yes[22] | Yes[23] | Yes | No | No | Yes | ||
| Epylog[24] | 2014 | Yes[25] | Yes[26] | Yes | No | No | Yes | ||
| SWATCH[27] | 2015 | Yes[28] | Yes[29] | Yes | No | No | Yes | ||
| sagan | 2021 | Yes[30] | No | No | No | No | Yes | ||
| aide | 2025 | Yes[31] | Yes[32] | Yes | Yes | No | No | yes | uses libs for routines |
| tripwire | 2018 | Yes[33] | Yes[34] | Yes | Yes | No | No | ||
| Tiger | 2018 | Yes[35] | No | No | Yes | No | No | Yes | 3/42 modules are Debian specific. |
Proprietary software
| Package | Year[36] | Linux | Windows | File | Network | Logs | Config | Notes |
|---|---|---|---|---|---|---|---|---|
| Lacework | 2018 | Yes | No | Yes | Yes | Yes | Yes | |
| Verisys | 2018 | Yes | Yes | Yes | Yes | Yes | ||
| Nessus | 2017 | Yes | Yes | Yes | ||||
| Atomicorp | 2019 | Yes | Yes | Yes | Yes | Yes | Yes | Commercially enhanced version of OSSEC |
| Spartan | 2021 | No | Yes | Yes | Yes | Yes | Yes | Websocket API, IP to Country mapping, DynDNS Integration |