OSSEC

OSSEC is a host-based intrusion detection system that watches the servers it runs on. It combines HIDS, log monitoring, and SIM/SIEM-style correlation in one agent to surface attacks and policy violations across a fleet.

It performs log analysis, file integrity checking, policy and compliance monitoring, rootkit detection, real-time alerting, and active response that can block or react to threats automatically. Detection runs from a central manager fed by lightweight agents on each host.

Extensive configuration lets you tune alert rules and plug in custom scripts, mapping checks to standards such as PCI-DSS and NIST 800-53. Agents cover Linux, Windows, and macOS, while the manager runs on Unix-like systems.