Which is described as a host-based open-source IDS?

Which is described as a host-based open-source IDS?

• A. OSSEC
• B. Snort
• C. Sguil
• D. Signature Recognition

Answer: (A)

Host-based intrusion detection focuses on monitoring an individual system’s activity, logs, and state rather than watching network traffic. OSSEC is an open-source host-based intrusion detection system that runs on endpoints as an agent, collecting and analyzing log data, performing file integrity checks, detecting rootkits, and sending alerts to a central manager. This host-centric design gives visibility into what’s happening on the specific machine, which is exactly what a host-based IDS aims to provide. In contrast, Snort is a network-based IDS that inspects traffic across a network segment, Sguil is a GUI framework for network security monitoring rather than a host-specific tool, and “Signature Recognition” isn’t a standard name for a host-based IDS. Therefore OSSEC best fits the description.

Host-based intrusion detection focuses on monitoring an individual system’s activity, logs, and state rather than watching network traffic. OSSEC is an open-source host-based intrusion detection system that runs on endpoints as an agent, collecting and analyzing log data, performing file integrity checks, detecting rootkits, and sending alerts to a central manager. This host-centric design gives visibility into what’s happening on the specific machine, which is exactly what a host-based IDS aims to provide. In contrast, Snort is a network-based IDS that inspects traffic across a network segment, Sguil is a GUI framework for network security monitoring rather than a host-specific tool, and “Signature Recognition” isn’t a standard name for a host-based IDS. Therefore OSSEC best fits the description.