OSSEC is a scalable, multi-platform, open source Host-based Intrusion Detection System (HIDS). It has a powerful correlation and analysis engine, integrating log analysis, file integrity checking, Windows registry monitoring, centralized policy enforcement, rootkit detection, real-time alerting and active response.It runs on most operating systems, including Linux, OpenBSD, FreeBSD, MacOS, Solaris and Windows.
Check out What’s New for the latest release info.
OSSEC is a free software and will remain so in the future; you can redistribute it and/or modify it under the terms of the GNU General Public License (version 2) as published by the FSF – Free Software Foundation.
OSSEC is a growing project, with more than 5,000 downloads per month on average. It is being used by ISPs, universities, governments and even large corporate data centers as their main HIDS solution. In addition to being deployed as an HIDS, it is commonly used strictly as a log analysis tool, monitoring and analyzing firewalls, IDSs, web servers and authentication logs.
There are a number of options for both community and commercial support for OSSEC.
You can post issues and get caught up on OSSEC development at the OSSEC Github account.
Questions about installation, usage and configuration should be sent to this list. It has a low volume of messages (around 120/150 per month) and is the best way to have your questions answered.
Please note that the “community” support is provided by volunteers, and even though they will do their best to answer and help you, this may not be always possible. The rules are: be polite and provide enough information so everyone can understand your issue.
To subscribe to the ossec-list:
Send an email to ossec-list+subscribe@googlegroups.com with the subject of Subscribe ossec-list.
Messages should be sent to ossec-list@googlegroups.com
To unsubscribe:
Send an email to ossec-list+unsubscribe@googlegroups.com.
Development questions, patches and anything related to coding should be sent to the ossec-dev list. It has a very low volume of messages (around 20/30 per month) and is highly technical.
To subscribe to ossec-dev:
Send an e-mail to ossec-dev+subscribe@googlegroups.com with the subject of Subscribe ossec-dev.
Messages should be sent to ossec-dev@googlegroups.com.
To unsubscribe:
Send an email to ossec-dev+unsubscribe@googlegroups.com.
Atomicorp
Atomicorp is the producer of Atomic Secured Linux™ which features a secure Linux system that includes OSSEC as one of its core technologies. Atomicorp provides comprehensive support services for all your security needs including deployment assistance and post-sale support for OSSEC. The company has long been involved with the OSSEC Project and currently builds the OSSEC RPM packages for each release. You can find out more about Atomicorp product and support offerings by contacting their sales team at sales@atomicorp.com or visiting their products listing page at: https://atomicorp.com/product-listing/.
Currently the core OSSEC Team consists of the following developers and committers:
Scott R. Shinn – OSSEC Development Manager – scott (at) atomicorp.com
Dan Parriott – Community support, docs, rules, testing – ddpbsd (at) gmail.com
Dominik Lisiak – FreeBSD port maintainer – mobstef (at) ossec.net
Daniel B. Cid – Founder of the OSSEC Project – dcid (at) dcid.me
Michael Starks – Community Support, rules
Vic Hargrave – Development, testing – vichargrave (at) gmail.com
Jeremy Rossi – OSSEC Development Manager – jeremy (at) jeremyrossi.com
Santiago Bassett – DEB repositories, SIEM integration – santiago (at) wazuh.com
Brad Lhotsky – Development, system integration, rules – brad . lhotsky (at) gmail.com
Andrew Widdersheim – Development, testing, rules – awiddersheim (at) hotmail.com
Jia-Bing (JB) Cheng – SIEM integration, community support – Jia-BingJB_Cheng (at) trendmicro.com
Development
Meir Michanie <meirgotroot@gmail.com>
Slava Semushin <php-coder@altlinux.org>
Ahmet Ozturk <oahmet@metu.edu.tr>
George Kargiotakis
Jason Stelzer
Xavier Mertens
Stjepan Gros
cmlara
Christian Gottsche <cgzones@googlemail.com>
Dominic
Cristobel <rosa@alienvault>
jp.zurbrugg
Bil Hays <bil_hays@unc.edu>
Wouter Clarie <wclarie@gmail.com>
Mario Weigel
Christian Beer <christian.beer@posteo.de>
Gael Muller <gael.muller@sekoia.fr>
Ky-Anh Huynh <z1y@theslinux.org>
Dan Garthwaite <dan@garthwaite.org>
Lance A. Brown <lance@bearcircle.net>
danpop60 <dan.pop@eservglobal.com>
Martin DiViaio <martindiv@yahoo.com>
Michael Boyd <denied39@gmail.com>
ibatten <igb+github@batten.eu.org>
rhelfter <rhelfter@yahoo.com>
Peter Drake <peter.drake@acquia.com>
Mikey Austin <mikey@ayuda.com.au>
Harshil Mathur <harshilmathur@gmail.com>
Ryan Schulze <ryan@dopefish.de>
navtej <n.s.buttar+github@gmail.com>
Hakisho Nukama <nukama@gmail.com>
Danny Fullerton <northox@mantor.org>
Justin Gerace <jgrace103@gmail.com>
jknockaert <jasper@knockaert.nl>
Jason Stelzer <jason.stelzer@gmail.com>
Antonio Querubin <tony@lavanauts.org>
Testing/Patches Rules and other contributions.
Cédric Bleimling <cedri@dryades.org
Dean Takemori <dtakemori@thdfsg.com>
Sebastien Tricaud <toady@gscore.org>
Jeff Schroeder <jeffschroeder@computer.org>
Giannis Vrentzos <gvre@gvre.gr>
Peter Ahlert <peter@ifup.de>
Rafael Capovilla <under@underlinux.com.br>
Andre Alexandre Gaio <aagaio@linwork.com.br>
Liliane A. Cid <liliane.cid@gmail.com>
Marcus Maciel <marcus@underlinux.com.br>
Stephen Kreusch <stephen.kreusch@gmail.com>
Kayvan A. Sylvan <kayvan@sylvan.com>
Dianzhi Wang <wangdz@leadsec.com.cn>
Meir Michanie <meirgotroot@gmail.com>
Stephen Bunn <sbunn@roguesoftware.net>
Jonathan Scheidell <jscheidell@secnap.net>
|SaMaN| <saman@ttnet.net.tr>
ChuckD <mdmonk@gmail.com>
Jorge Augusto Senger <jorge@br10.com.br> - ossec2mysql (contrib)
David J. Bianco <david at vorant.com>
Ivan Lotina <lotke@lotke.com>
Robert Millan [ackstorm] <rmillan@ackstorm.es>
Martin West <martin@objectgizmos.com>
Rafael Capovilla <under@underlinux.com.br>
Florian Crouzqat
Danny Fullerton
Jeremy Hanmer
Pepe Sanz
Kat Fitzgerald
Regis Houssin
carlopmart
Ash Kumar
Alexandro Silva
Mike Downey <michael.downey01@gmail.com>
Hai Nguyen <hainguyen@uns.vn>
Jeffrey Jackson <jeffreyclarkejackson@gmail.com>
Ben Chavet <ben.chavet@lullabot.com>
Bill Parker <wp02855@gmail.com>
Schnaffon <schnaffon@hotmail.fr>
Ralf Spenneberg <ralf@os-t.de>
Darren Worrall <darren@iweb.co.uk>
aalberdi <aalberdi@indra.es>
Translations
- Dutch:
Martijn de Boer <martijn@oceanius.com>
- Serbian:
Maja Michanie <majam@riunx.com>
- Portuguese:
Daniel Barcellos <danielpoa.rs@gmail.com>
Allan Soares <allan.soares@gmail.com>
Willian Itiho Amano <itihoitiho@gmail.com>
Liliane Cid <liliane.cid@gmail.com>
- German:
Peter Ahlert <peter@ifup.de>
- Turkish
Ahmet Ozturk <oahmet@metu.edu.tr>
- Polish
Dziankowski Krzysztof <odpadki@poczta.onet.pl>
- Italian
Alberto Furia <straluna@email.it>
- French
Yves Bigliazzi <yves.bigliazzi@gmail.com>
- Japanese
Kuzuno Hiroki <kuzuno@gmail.com>
- Russian
Yuri Slobodyanyuk <yurisk@inbox.ru>
- Spanish
Meir Michanie <meirgotroot@gmail.com>
- Chinese
Brian Wang <junchangwang@gmail.com>