Setting Up OSSEC and Wazuh HIDS for Host Intrusion Detection

Setting Up OSSEC and Wazuh HIDS for Host Intrusion Detection

On one project, an attacker gained access to a host through an SQL injection in a web application and modified /usr/bin/ssh. Network security systems remained silent because the traffic was legitimate. Only a HIDS in real-time detected the hash change and instantly alerted the engineer. Host-based Intrusion Detection System is the last line of defense that can notice anomalies at the operating system level that NIDS cannot see. Our team configure OSSEC and its fork Wazuh for clients in fintech and retail. Over 5+ years, we have deployed HIDS on more than 5000 hosts—we know the typical pitfalls and how to quickly bypass them. Wazuh is free, saving budget on licenses compared to commercial alternatives such as CrowdStrike.

Why HIDS and Not Just NIDS?

NIDS catches anomalies in traffic but is powerless when an attacker has already penetrated inside. For example, a quick rootkit (replacing ls) does not generate network packets, but HIDS will detect the hash discrepancy. File Integrity Monitoring (FIM) is one of the key features: baseline + checks every 2 hours (configurable via frequency). For critical directories (/etc, /usr/bin, /var/www), we enable realtime="yes"—inotify immediately generates an event on change. The alert includes a diff of the changed file, showing exactly what was modified. With proper FIM configuration, we reduce false positives to 1-2% by excluding temporary files and directories with frequent changes. We use whitelists and regular expressions for filtering.

How Does Rootkit Detection Work?

OSSEC checks for hidden processes: differences between /bin/ps output and reading /proc, hidden files in /dev, suspicious kernel modules. The known rootkit database is rootkit_files.txt, plus integrity checks against trojan lists. Default rootcheck configuration (sufficient):

<rootcheck>
  <frequency>36000</frequency>
  <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
  <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
</rootcheck>

For compliance (PCI DSS, SOX), we add CIS checks via system_audit_cis_rcl.txt. In one project, rootcheck detected a rootkit masquerading as a sound card driver—this prevented a client data leak.

How to Configure Rootcheck for Maximum Effectiveness?

To achieve the best results, we select directories for integrity checking (all system binaries, libraries, configs), configure frequency: real-time for critical files, 2-4 hours for others. Then we integrate with SIEM: all alerts are sent to Elasticsearch or Splunk for centralized analysis. We regularly update rootkit databases and detection rules using automatic updates from Wazuh. We conduct penetration tests to verify detection. Our engineers will help you configure rootcheck considering your infrastructure specifics.

How to Configure Active Response for Incidents?

Detection is one thing, automatic response is another. Active response links a rule to an action: IP blocking via host-deny, process termination, script execution. Example: SSH brute force—rule 5720 (8 password failures) → add IP to /etc/hosts.deny for one hour. IP blocking prevents damage from an attack that could cost millions.

<active-response>
  <command>host-deny</command>
  <location>local</location>
  <rules_id>5720</rules_id>
  <timeout>3600</timeout>
</active-response>

The agent executes the command locally—no need to wait for the server. Blocking duration is configurable, can be replaced with a firewall rule (iptables). For large infrastructures, we use automatic blocking at the firewall via API.

Why Choose Wazuh Over Original OSSEC?

For new projects, we choose Wazuh—it processes events 3 times faster than the original and provides a ready-made monitoring dashboard. Wazuh also supports containers and Kubernetes, which is critical for modern DevOps practices. Wazuh is free, saving budget on licenses compared to commercial HIDS whose cost can reach hundreds of about $9–13 in savings per year.

What Typical Mistakes Are Made When Configuring HIDS?

• Scanning all directories too frequently creates load and many false positives. Configure real-time only for /etc, /usr/bin, and the web root.
• Ignoring whitelists: temporary log and cache files should be excluded.
• Lack of testing active response: blocking your own IP can paralyze operations.
• Not updating rootkit databases—new threats are missed.

What Is Included in Turnkey HIDS Setup?

• Audit of current infrastructure: which hosts, OSes, load.
• Choice of fork and architecture (server/agents/centralized collection).
• Installation and configuration: FIM, rootcheck, log analysis, active response.
• Integration with your SIEM (ELK, Splunk, CloudWatch).
• Documentation on rules and response procedures.
• Team training (2 hours) and guarantee of correct configuration (7-day test).

We are certified on Wazuh and OSSEC—engineers with 5+ years of experience. We support both small clusters (10 hosts) and large ones (2000+).

Contact us for an audit of your infrastructure—we will select the optimal HIDS and configure it considering your compliance requirements. Order a turnkey OSSEC setup: we guarantee the system will catch incidents, not generate a flood of false positives. Get a consultation from an engineer today.