How to: OSSEC - Host Intrusion Detection
#### Why
From [https://github.com/ossec/ossec-hids](https://github.com/ossec/ossec-hids)
> OSSEC is a full platform to monitor and control your systems. It mixes together all the aspects of HIDS (host-based intrusion detection), log monitoring and SIM/SIEM together in a simple, powerful and open source solution.

#### Goals

- OSSEC-HIDS installed

#### References

- https://www.ossec.net/docs/

#### Steps

1. Install OSSEC-HIDS from sources
    ```bash
    sudo apt install -y libz-dev libssl-dev libpcre2-dev build-essential libsystemd-dev
    wget https://github.com/ossec/ossec-hids/archive/3.7.0.tar.gz
    tar xzf 3.7.0.tar.gz
    cd ossec-hids-3.7.0/
    sudo ./install.sh
    ```

1. Useful commands:

**Agent information**

   ```bash
    sudo /var/ossec/bin/agent_control -i
```
`AGENT_ID` by default is `000`, to be sure the command `sudo /var/ossec/bin/agent_control -l` can be used.

**Run integrity/rootkit checking**

OSSEC by default run rootkit check each 2 hours.

   ```bash
    sudo /var/ossec/bin/agent_control -u
-r 
   ```

**Alerts**

- All:
    ```bash
    tail -f /var/ossec/logs/alerts/alerts.log
    ```
- Integrity check:
    ```bash
    sudo cat /var/ossec/logs/alerts/alerts.log | grep -A4  -i integrity
    ```
- Rootkit check:
    ```bash
     sudo cat /var/ossec/logs/alerts/alerts.log | grep -A4  "rootcheck,"
    ```

([Table of Contents](#table-of-contents))