configuring-host-based-intrusion-detection

Configure FIM in the agent's ossec.conf syscheck block by listing directories with check_all and realtime attributes, setting a scan frequency, and adding ignore rules for noisy files like logs. Critical paths include /etc, /usr/bin, and Windows System32 plus registry Run keys.

On Windows, install the MSI with WAZUH_MANAGER and WAZUH_AGENT_GROUP parameters, then start WazuhSvc. On Debian/Ubuntu, add the Wazuh APT repository, install wazuh-agent, set the manager IP in ossec.conf, and enable the systemd service.

Wazuh is an actively maintained OSSEC fork adding a manager, dashboard, and SIEM integration, making it suited for centralized fleets. OSSEC is the original HIDS, while AIDE is a standalone file integrity checker for single Linux hosts without agent-manager architecture.

Realtime monitoring only works with inotify on Linux or the USN journal on Windows; on NFS or overlay mounts it silently falls back to the scheduled 12-hour scan. Verify by touching a watched file and confirming a rule 550 or 554 alert fires within seconds.

A registered agent may be disconnected; check agent_control -l for Active status rather than Never connected. Also confirm local rule levels meet the manager's log_alert_level threshold and that ports 1514 and 1515 are open.

Do not use HIDS for network traffic analysis; that requires network-based IDS like Suricata or Snort. HIDS also does not replace EDR platforms, which provide deeper behavioral telemetry and response capabilities beyond file integrity and log monitoring.