An intrusion detection system is a device or software application that monitors a network or systems for malicious activity or policy violations.
IDS types range in scope from single computers to large networks. The most common classifications are network intrusion detection systems (NIDS) and host-based intrusion detection systems (HIDS). A system that monitors important operating system files is an example of an HIDS, while a system that detects malicious traffic on a network is an example of an NIDS.
Here’s our verdict on the finest HIDS. We only feature open source software here.
Let’s explore the 12 HIDS. For each application we have compiled its own portal page, a full description with an in-depth analysis of its features, together with links to relevant resources.
| Host-Based Intrusion Detection Systems | |
|---|---|
| Wazuh | Platform used for threat prevention, detection, and response |
| OSSEC | Full platform to monitor and control your systems. |
| Falco | Cloud native runtime security tool |
| Tracee | Runtime security and observability tool |
| AIDE | Advanced Intrusion Detection Environment |
| Logwatch | Powerful and versatile log parser and analyzer |
| Samhain | File integrity checking and log file monitoring/analysis and more |
| Sagan | Multi-threads, high performance log analysis engine |
| Hades | Uses eBPF and the netlink process connector to monitor activity |
| rkhunter | Scans for rootkits, backdoors and possible local exploits |
| Tripwire | Security and data integrity tool |
| chkrootkit | Locally checks for signs of a rootkit |
This article has been updated to reflect the changes outlined in our recent announcement.
If you’re looking for software-based NIDS, we recommend the best free and open source solutions in this separate article. NIDS can protect hundreds of computer systems from one network location. This helps make them a cost effective solution and easier to deploy than a HID.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.
While Samhain is difficult to install, it’s technically superior to Tripwire OSS, AIDE, and OSSEC. (Tripwire went closed source.) Fail2ban is NOT a HIDS solution, it’s an application firewall. If you’re exposing ssh and internal network infrastructure to the outside world, then you have bigger security attack surface problems that cannot be solved by rate-limiting ssh.
Fail2ban is best described as intrusion prevention software. While technically not a HIDS, I don’t have a problem with it being covered here. Both monitor a network for malicious activity and/or policy violations.