|
|
|
|
| |
Credit:
The information has been provided by Jeremy Pickett.
To keep updated with the tool visit the project's homepage at: http://www.openhids.com/
|
| |
Open HIDS is a free, near-real time host intrusion detection system. the agent supports windows clients and servers, with other operating systems planned.
The agent works by examining a number of resources on the host:
* NT event log
* Registry
* File integrity
* Directories
* Services
* Users
Each of the modules creates a baseline for each resource. when changes occur on the monitored agent, those changes are compared against a set of filters and rules. if the particular change is of interest, the agent sends the event to the management server.
The agent currently supports communication to the management server via UDP, and also makes a local archive of each event. It is advisable to keep the management server and agents on an isolated network that cannot be packet sniffed.
|
|
|
|
|
