This project focuses on the research and deployment of a Host-Based Intrusion Detection System (HIDS) using OSSEC integrated with the ELK Stack. By combining OSSEC’s detection capabilities with ELK’s visualization power, this project establishes a functional SIEM (Security Information and Event Management) architecture.
The system is built on a modern security stack:
- OSSEC: Core HIDS engine for log analysis, file integrity monitoring, and active response.
- ELK Stack:
- Elasticsearch: Distributed search and analytics engine for log storage.
- Logstash: Data processing pipeline for log normalization and enrichment.
- Kibana: Visualization dashboard for security event monitoring.
-
Unauthorized Access Detection: Monitoring auditd events for "admin-only" files. Demo: Link
-
Agentless Monitoring: Using SSH to monitor routers and firewalls without agent installation. Demo: Link
-
Windows Registry Protection: Detecting changes in Service keys and triggering a System Restore Point as an active response. Demo: Link
-
Rootkit Scanning: High-severity alerts for hidden malware signatures. Demo: Link
-
Web Application Defense: Identifying SQL injection payloads in access.log and automatically dropping the source IP. Demo: Link