Alternatives to OSSEC

An open-source host-based intrusion detection system with log analysis, file integrity monitoring and active response. The listings below can replace it for an important use case. Each note says what changes if you switch.

Replacements

Listings that take over the same core job as OSSEC.

  • Wazuh Agent

    Endpoint agent that feeds a Wazuh server with security and compliance data.

    FreeOpen sourceWindowsLinux

    Wazuh Agent covers file integrity monitoring, log collection, rootkit detection and configuration assessment on Windows and Linux, but needs a Wazuh manager and indexer.

  • AIDE

    A file and directory integrity checker that records file attributes and hashes, then reports changes.

    FreeProprietaryLinuxCommand line

    AIDE covers only file integrity checking with hashes and attributes on Linux, without log analysis or active response, and it has no graphical interface.

  • CrowdSec

    Detect suspicious behavior in server logs and web traffic.

    FreeOpen sourceWindowsLinux

    CrowdSec is an MIT tool that detects suspicious behaviour in server logs and web traffic with community intelligence, but lacks file integrity monitoring and needs enforcement integrations.

Also worth comparing

These listings name OSSEC as their own alternative, so the relationship runs both ways.

  • chkrootkit

    A command-line tool that checks Unix-like systems locally for signs of a rootkit.

    FreeOpen sourceLinuxCommand line

    OSSEC is a self-hosted host intrusion detection system combining log analysis, file integrity monitoring and rootkit detection with active response, beyond chkrootkit's local checks.

  • Fail2ban

    Log-watching daemon that bans addresses after repeated authentication failures.

    FreeOpen sourceLinuxSelf-hostedCommand line

    OSSEC is a self-hosted host intrusion detection system that combines log analysis with file integrity monitoring and active response, giving broader coverage with more configuration to learn.

  • Velociraptor

    Endpoint monitoring and digital forensics platform driven by a query language.

    FreeOpen sourceWindowsmacOSLinux

    OSSEC is a self-hosted host intrusion detection system with log analysis, file integrity monitoring and active response, but it has no query language for collecting arbitrary host state.

Similar software

Related functionality, not a direct replacement.