domains / families / security / configuring-host-based-intrusion-detection

configuring-host-based-intrusion-detection

separate

'Configures host-based intrusion detection systems (HIDS) to monitor

When to use

• Deploying HIDS agents (Wazuh, OSSEC, AIDE) across Windows and Linux endpoints
• Configuring file integrity monitoring (FIM) for compliance (PCI DSS 11.5, NIST SI-7)
• Monitoring system configuration changes, rootkit detection, and security policy violations
• Integrating HIDS alerts with SIEM platforms for centralized monitoring

When not to use

• Network-based IDS (Suricata, Snort)
• EDR deployment

Skill page

Source