Welcome to OSSEC HIDS’s documentation!

OSSEC is an open source host based intrustion detection system. It performs log monitoring, file integrity monitoring, Windows registry monitoring, rootkit detection, real-time alerting, and active-response. It runs on Microsoft Windows, and most modern Unix-like systems including Linux, FreeBSD, OpenBSD, and Solaris.

Contents:

• About OSSEC
  • OSSEC Architecture
    • Linux and unix-like systems
    • Windows
    • Agent/Server Communication
    • Agentless and Network Devices
    • User List
    • Process List
  • Supported Systems
    • Operating Systems
    • Devices Supported via syslog
    • Devices and Operating Systems via Agentless
    • Notes about support
• OSSEC Manual
  • Installation
    • Installation Types
    • Installations requirements
    • Build Options
    • Install from source
    • Package Installation
    • Windows Agent Installation
    • Compiling OSSEC for a Binary Installation
    • Compiling OSSEC 3.x with MinGW
  • Agent Management
    • manage_agents
    • Adding an agent
    • ossec-authd
    • Adding an agent example
    • Adding an agent with authd example
  • Agentless Management
    • agentlessd
    • Adding Hosts
  • Log Monitoring
    • What is log monitoring
    • log files
    • commands
    • syslog
  • Decoders and Rules
    • Decoders
    • Rules
  • Regular Expression Syntax
    • pcre2
    • OS_Regex/regex
    • OS_Match/sregex
• Configuration
  • ossec.conf
    • global
    • client
    • remote
    • syscheck
    • rootcheck
    • localfile
    • rules
    • command
    • active-response
    • alerts
    • email_alerts
    • syslog_output
    • database_output
    • agentless
    • reports
  • agent.conf
    • Syntax
    • os
    • name
    • profile
    • Minimal ossec.conf
    • Settings that will not work
    • Examples
• Documentation
  • Current documentation
  • Legacy documentation
  • Helping out

Legacy Documentation

Contents:

• Legacy Documentation
  • Manual & FAQ
  • Development
  • Reference

Indices and tables

• Index
• Module Index
• Search Page