1. OSSEC HIDS ● Jonathan Schipp ● Dubois County Linux User Group ● Sept 4 th, 2011 ● jonschipp (at) gmail.com

2. What is a HIDS? ● Host Intrustion Detection System ● Intrusion Detection is the process or techniques used to detect attacks on a specific network, system or application. Most intrusion detection tools not only detect attacks, but also software misuse, policy violations and other forms of inappropriate activities. ● A Host-based IDS performs intrusion detection from within the systems you want to protect. Some of these tools perform log analysis, others spyware detection, while others perform virus detection..

3. Security log analysis ● Security Log analysis is the process or techniques used to detect attacks on a specific network, system or application using logs as the primary source of information ● Logs can be anything from firewall logs, web server logs, system logs, IDS events or Windows event logs. ● Log analysis is also used to detect software misuse, policy violations and other forms of inappropriate activities.

4. What is a LIDS? ● LIDS (Log-based intrusion detection systems) is just a fancy term for tools that perform security log analysis (specified above). It's goal is to detect misuse (or attacks) using logs as the primary source of information. It is not a replacement for NIDS (Network-based IDS) or any other security solution, but an addition to them.

5. Software ● OSSEC ● Tripwire ● Tiger ● Linux Intrusion Detection System (LIDS)

6. OSSEC ● Developed by TrendMicro ● Free ● Supported OS's: Linux, OpenBSD, FreeBSD, MacOS, Solaris, AIX, HP-UX, and Windows ● Easy to install ● Write customize rules, watch specific logs ● Handles logs from popular firewalls, switches, and routers

7. Supported Devices ● Cisco PIX, ASA and FWSM (all versions) ● Cisco IOS routers (all versions) ● Juniper Netscreen (all versions) ● SonicWall firewall (all versions) ● Checkpoint firewall (all versions) ● Cisco IOS IDS/IPS module (all versions) ● Sourcefire (Snort) IDS/IPS (all versions) ● Dragon NIDS (all versions) ● Checkpoint Smart Defense (all versions) ● McAfee VirusScan Enterprise (v8 and v8.5) ● Bluecoat proxy (all versions) ● Cisco VPN concentrators (all versions)

8. Features ● Log analysis ● File integrity checking ● Windows registry monitoring ● Centralized policy enforcement ● Rootkit detection ● Real-time alerting and active response. ● ^ HIPS ^ lol

9. Log Analysis – How it Works ● Live Demo

10. Deployment Types ● Local – One machine, full deployment ● Server – Collects log data from agents ● Agents – Sends log data to server for analysis ● Agentless – For systems that you can’t install an agent, OSSEC allows you to perform file integrity monitoring on them without the agent installed.

11. Installation ● Live Demo ● Current Version: 2.6 ● http://www.ossec.net/main/manual/manual-installation

12. Managing OSSEC ● Live Demo ● http://www.ossec.net/doc/

13. Copy/Paste References ● ossec.net