OSSEC HIDS

No entries match these filters. Clear filters

1. 4.4.0 Oct 5, 2026 · issue 096

   OSSEC 4.4.0 adds Windows FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification. check_attrs/check_acl opt-ins, GeoLite2 MMDBMMDBA binary database file format designed for fast IP-address lookups, maintained by MaxMind, used by cyber tools to resolve IPs to geolocation or ASN data without external API calls. GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. enrichment, and JSON syslog alert forwarding via ossec-csyslogd.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.4.0 https://github.com/ossec/ossec-hids.git
   # already have the repo? check out this version:
   $ git checkout 4.4.0

   • Adds opt-in check_attrs config key to Windows FIM to alert on Hidden/System/attribute changes.
   • Adds opt-in check_acl config key to Windows FIM to alert on NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT. DACL/ACE matrix changes.
   • New detectionReplaces EOL GeoIP Legacy with libmaxminddb (GeoLite2 MMDB) for GeoIP lookups in analysisd, adding ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. and country enrichment.
   • Enables ossec-csyslogd to forward analysisd JSON alerts over syslog with agent_name as a first-class field.
   • Makes jsonout remain enabled when the XML tag is omitted, with alert rotation handled by monitord.

   5 details in Everything

2. docs update Sep 22, 2026 · issue 082

   OSSEC HIDS rule-list files now support trailing comments using the ### delimiter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Annotate an OSSEC rule-list file with section headers and inline comments while preserving # characters inside values such as URL anchors.
   text copy

   ### Approved internal networks
   ### private LAN
   url https://example.com/page#anchor ### keep the # in the value

   • Adds trailing comment support to rule-list files using the ### multi-character delimiter; everything from ### to end-of-line is discarded at compile time, and leading spaces/tabs before ### are stripped so stored values carry no trailing whitespace.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • A single # is explicitly not a comment marker, allowing keys and values to contain # characters (e.g. URL fragments) without escaping.

   2 details in Everything

3. docs update Sep 22, 2026 · issue 082

   OSSEC HIDS Logcollector gains modsec-audit format for ingesting full ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application. serial audit logs as single events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Ingest the full ModSecurity serial audit log so each WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. transaction reaches analysisd as one correlated event, rather than fragmented lines.
   /var/ossec/etc/ossec.conf copy

   <localfile>
     <log_format>modsec-audit</log_format>
     <location>/var/log/modsec_audit.log</location>
   </localfile>

   • Adds modsec-audit log format to Logcollector, which reads serial ModSecurity/libmodsecurity audit files (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ /var/log/modsec_audit.log), collects one full transaction from the --id-A-- header through the --id-Z-- trailer, and emits it as a single event to analysisd.

   1 detail in Everything

4. announced Aug 25, 2026 · issue 078

   OSSEC 4.3.0 adds FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification. maintenance mode, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./TLS syslog output, and ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application. audit log collection⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Pause FIM alerting on a single agent during a planned maintenance window so file changes are silently absorbed into the baseline instead of generating floods of integrity alerts.
   copy

   $ agent_control -M enable -u 042

   Forward OSSEC alerts over an encrypted TLS syslog channel to a remote SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents., replacing the default unencrypted UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. transport.
   /var/ossec/etc/ossec.conf copy

   <syslog_output>
     <server>siem.example.com</server>
     <port>6514</port>
     <protocol>tcp</protocol>
     <tls>yes</tls>
     <tls_verify>yes</tls_verify>
     <tls_ca>/var/ossec/etc/ca-bundle.crt</tls_ca>
     <format>json</format>
   </syslog_output>

   Ingest libmodsecurity audit events into OSSEC so WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. block decisions appear alongside host-level alerts.
   /var/ossec/etc/ossec.conf copy

   <localfile>
     <log_format>modsec-audit</log_format>
     <location>/var/log/modsec_audit.log</location>
   </localfile>

   • Adds per-agent FIM maintenance mode via agent_control -M with subcommands enable, disable, status, and end plus -u <id> to suppress integrity alerts while accepting file changes into the baseline.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds TCP and optional TLS support to ossec-csyslogd syslog output via new protocol, tls, tls_verify, and tls_ca config keys in syslog_output.
   • Raises the ossec-csyslogd alert payload buffer from 2048 bytes to OS_MAXSTR for default, CEFCEFCommon Event Format, an ArcSight (Micro Focus) log standard that defines a fixed header plus extensible key-value pairs so cyber tools can emit and ingest alerts in a predictable, parseable structure., JSON, and Splunk alert formats.
   • Adds modsec-audit localfile format to collect libmodsecurity serial audit logs, plus new decoders and rules for nginx ModSecurity error-log events.
   • Supports manage_agents -f - to bulk-load agents from stdin.

   +9 more show less

   • Adds a dedicated OSSEC iptables chain for the firewall-drop active response.
   • Adds cPanel/cpsrvd decoders and rules for monitoring cPanel services.
   • Adds Postfix SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. connect-abort detection with escalation by source IP.
   • Matches Snort [Drop] fast alerts in the snort decoder.
   • Decodes named client IPs with optional BIND @cookie prefix.
   • Adds Windows interactive logon (logon type 2) success detail rule 18262.
   • Backs up agent state before remove or force-delete and alerts on duplicated IP.
   • Supports ### trailing comments in CDB list text files.
   • Adds Asterisk IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. denied decoder so srcip omits square brackets.
   • Adds per-agent FIM maintenance mode via agent_control -M with subcommands enable, disable, status, and end plus -u <id> to suppress integrity alerts while accepting file changes into the baseline.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds modsec-audit localfile format to collect libmodsecurity serial audit logs, plus new decoders and rules for nginx ModSecurity error-log events.
   • Adds cPanel/cpsrvd decoders and rules for monitoring cPanel services.
   • Adds Postfix SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. connect-abort detection with escalation by source IP.
   • Adds Windows interactive logon (logon type 2) success detail rule 18262.

   9 more in Everything

5. 4.3.0 Aug 25, 2026 · issue 057

   OSSEC 4.3.0 adds FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification. maintenance mode, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./TLS syslog output, and ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application. audit log collection

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.3.0 https://github.com/ossec/ossec-hids.git
   # already have the repo? check out this version:
   $ git checkout 4.3.0

   └──▷ TRY IT
   Pause FIM alerting on a specific agent during a planned change window so file modifications are absorbed into the baseline without generating integrity alerts.
   copy

   $ agent_control -M enable -u 042
   # ... perform maintenance ...
   agent_control -M end -u 042

   Forward OSSEC alerts to a remote syslog collector over TLS-secured TCP instead of UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery., with server certificate verification.
   /var/ossec/etc/ossec.conf copy

   <syslog_output>
     <server>siem.example.com</server>
     <port>6514</port>
     <protocol>tcp</protocol>
     <tls>yes</tls>
     <tls_verify>yes</tls_verify>
     <tls_ca>/var/ossec/etc/ca.pem</tls_ca>
     <format>json</format>
   </syslog_output>

   Collect libmodsecurity serial audit logs from a web application firewall for decoding and alerting by OSSEC.
   /var/ossec/etc/ossec.conf copy

   <localfile>
     <log_format>modsec-audit</log_format>
     <location>/var/log/modsec_audit.log</location>
   </localfile>

   • Adds FIM maintenance mode via agent_control -M with subcommands enable, disable, status, and end (plus -u <id> to target a specific agent), letting syscheck absorb file changes into the baseline without firing integrity alerts; end restarts syscheck/rootcheck and clears maintenance after the scan completes.
   • Adds TCP and optional TLS support to ossec-csyslogd syslog_output via new config keys protocol, tls, tls_verify, and tls_ca, in addition to existing UDP; alert payloads in default, CEFCEFCommon Event Format, an ArcSight (Micro Focus) log standard that defines a fixed header plus extensible key-value pairs so cyber tools can emit and ingest alerts in a predictable, parseable structure., JSON, and Splunk formats now support up to OS_MAXSTR instead of the former 2048-byte limit.
   • Adds modsec-audit localfile format to collect libmodsecurity serial audit logs, plus new decoders and rules for nginx ModSecurity error-log events.
   • Allows manage_agents -f - to bulk-load agents from stdin.
   • Adds support for ### trailing comments in CDB list text files.

   +10 more show less

   • Uses a dedicated OSSEC iptables chain for firewall-drop active response instead of the default chain.
   • Adds Postfix SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. connect-abort detection with escalation by source IP.
   • Adds matching of Snort [Drop] fast alerts in the Snort decoder.
   • Decodes named client IPs with an optional BIND @cookie prefix.
   • Adds cPanel/cpsrvd decoders and rules.
   • Adds Windows interactive logon (logon type 2) success detail rule 18262.
   • Backs up agent state before remove/force-delete and alerts on duplicated IP.
   • Adds Asterisk IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. denied decoder so srcip omits square brackets.
   • Enables Linux compile/link hardening by default (PIE, FORTIFY, stack protector, full RELRO).
   • Rejects dangerous or ambiguous syscheck_control flag combinations such as -r -u.

   15 details in Everything

6. docs update Aug 11, 2026 · issue 042

   OSSEC 4.2.0 adds a multi-threaded analysisd pipeline and bundles OpenSSL DLLs in the Windows agent installer.

   • Linux server installs of 4.2.0 gain an always-on multi-threaded analysisd pipeline; manager daemons also use pthreads and a shared thread pool — no configuration change required, but verify ossec-analysisd starts cleanly and alert volume matches expectations under load.
   • Windows agent installer for 4.2.0 bundles the MinGW/OpenSSL runtime DLLs required by the agent, removing reliance on system DLLs.

   2 details in Everything

7. 4.2.0 Aug 2, 2026 · issue 034

   OSSEC 4.2.0 adds a multi-threaded analysisd pipeline, rootcheck file-hash enrichment, pthread migration, and a self-contained Windows agent installer.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.2.0 https://github.com/ossec/ossec-hids.git
   # already have the repo? check out this version:
   $ git checkout 4.2.0

   • Adds an always-on multi-threaded analysisd event pipeline for Linux servers, improving analysisd scalability.
   • Appends MD5, SHA1, and SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hashes of detected rootcheck files to alerts, enriching forensic context.
   • Migrates manager daemons to pthreads and adds shared thread pool support.
   • Bundles required MinGW/OpenSSL runtime DLLs in the Windows agent installer, enabling self-contained deployment.
   • Adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. key validation via OS_IsValidIP for authd -i keys.

   +1 more show less

   • Indicates in alerts when report_changes diffs are truncated.

   6 details in Everything

8. 4.1.0 May 27, 2026 · release notes

   OSSEC 4.1.0 adds SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. TLS/auth, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. whitelisting, large file (>2GB) support, and Rocky Linux 9 builds.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.1.0 https://github.com/ossec/ossec-hids.git
   # already have the repo? check out this version:
   $ git checkout 4.1.0

   └──▷ HOW TO FIND IT
   Enable authenticated SMTP alerting so OSSEC can relay alerts through a mail server that requires TLS and credentials.
   📍In ossec.conf, under the <global> or <mail> block, configure SMTP TLS and authentication settings added to maild and monitord in this release. Refer to the updated maild/monitord configuration for the specific fields.
   • Adds SMTP TLS and authentication support to maild and monitord for authenticated email alerting.
   • Improves IPv6 whitelisting support in install.sh, enabling IPv6 addresses to be excluded from alerting.
   • Enables large file support (>2GB) in Makefile and hash operations, allowing monitoring of files previously beyond the size limit.
   • Increases default decoder field limit to 256 to support complex log formats.
   • Adds support for Rocky Linux 9 as a build and deployment platform.

   5 details in Everything

9. 4.0.0 Feb 1, 2026 · release notes

   OSSEC 4.0.0 ships AES encryption by default for agent comms and enables SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. file integrity monitoring out of the box.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.0.0 https://github.com/ossec/ossec-hids.git
   # already have the repo? check out this version:
   $ git checkout 4.0.0

   └──▷ USE IT
   Maintain connectivity between a new 4.0.0 agent and a legacy 3.8.0 server while you schedule the server upgrade.
   xml copy

   <client>
     <crypto_method>blowfish</crypto_method>
   </client>

   Opt a specific monitored directory out of SHA-256 hashing when a downstream tool only understands MD5/SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications. FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification. data.
   xml copy

   <syscheck>
     <directories check_sha256sum="no">/etc</directories>
   </syscheck>

   • Enables AES encryption by default for all agent-server communication, replacing Blowfish as the default cipher.
   • Enables SHA-256 checksums by default for all syscheck-monitored directories, modernizing file integrity monitoring.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !AES encryption is now the default for agent-server communication; OSSEC 4.0.0 agents are NOT backwards compatible with OSSEC 3.8.0 and older servers — upgrade servers first, or add <crypto_method>blowfish</crypto_method> inside <client> in the agent's ossec.conf to fall back to Blowfish.
   • !SHA-256 is now enabled by default for all monitored directories; installations that cannot support this can disable it by setting check_sha256sum="no" on each <directories> entry in <syscheck>.
10. 3.8.0 Jan 5, 2025 · release notes

    OSSEC 3.8.0 adds AIX 7.x support, authd privilege separation, and updated rootkit detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.8.0 https://github.com/ossec/ossec-hids.git
    # already have the repo? check out this version:
    $ git checkout 3.8.0

    • Adds support for AIX 7.x on POWER architecture (generations 8, 9, and 10).
    • Enforces chroot and privilege separation for the authd daemon, which now runs as the ossec user by default.
    • Updates rootkit detection signatures for 1stmile rootkit.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The authd daemon now runs as the ossec user by default and enforces chrooting — deployments relying on authd running as root or outside a chroot may need reconfiguration.
11. 3.7.0 Jan 17, 2022 · release notes

    OSSEC HIDS 3.7.0 adds Journald support, active response for nftables, and an AWS WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. analysis script

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.7.0 https://github.com/ossec/ossec-hids.git
    # already have the repo? check out this version:
    $ git checkout 3.7.0

    └──▷ USE IT
    Configure the HIDS to read logs from the systemd journal instead of traditional text files.
    config copy

    <localfile><location>journal</location></localfile>

    • Adds active_responses/local_commands/active-response/bin/ossec-aws-waf.sh to analyze AWS WAF logs.
    • Adds active_responses/local_commands/active-response/bin/ossec-nftables.sh for nftables-based active response.
    • Adds support for reading and parsing journald system logs.

    3 details in Everything

12. 3.6.0 Feb 14, 2020 · release notes

    OSSEC HIDS 3.6.0 adds PCRE2 support, new Sophos UTM timestamp decoding, and Debian auth log config.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.6.0 https://github.com/ossec/ossec-hids.git
    # already have the repo? check out this version:
    $ git checkout 3.6.0

    • Pre-decoder supports an additional non-standard syslog timestamp format for Sophos UTM appliances (@mwidman).

    1 detail in Everything

13. 3.5.0 Nov 18, 2019 · release notes

    OSSEC HIDS 3.5.0 adds multi-line_indented log analysis and Fedora 31 support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.5.0 https://github.com/ossec/ossec-hids.git
    # already have the repo? check out this version:
    $ git checkout 3.5.0

    └──▷ HOW TO FIND IT
    Configure an active-response or localfile rule to parse indented multi-line logs.
    📍<!-- No direct CLI usage for this new type; it is configured via the agent config file -->
    • Adds multi-line_indented type for multi-line log collection to handle indented logs like PostgreSQL
    • Adds OSSEC agent support for Fedora 31

    2 details in Everything

14. 3.4.0 Oct 18, 2019 · release notes

    OSSEC HIDS 3.4.0 adds PCRE2 engine, Snap packaging, and new active-response scripts

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.4.0 https://github.com/ossec/ossec-hids.git
    # already have the repo? check out this version:
    $ git checkout 3.4.0

    • Adds syscheck_control basic error handling to prevent silent failures during filesystem monitoring checks
    • Introduces active-response script for Cloudflare integration via scripts/active-responses/cloudflare.sh
    • Upgrades the IDS engine to use PCRE2 rules and decoders instead of older regex engines for complex and faster search functionality
    • Adds csyslogd CEFCEFCommon Event Format, an ArcSight (Micro Focus) log standard that defines a fixed header plus extensible key-value pairs so cyber tools can emit and ingest alerts in a predictable, parseable structure. escaping capability to handle multi-line syslog messages without discarding hashes
    • Adds logtest field name normalization by removing leading spaces from parsed fields

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !PCRE2 is enabled by default (set PCRE2_SYSTEM to yes to disable if your configuration relies on the legacy regex engine)
15. 3.3.0 Apr 19, 2019 · release notes

    OSSEC HIDS 3.3.0 adds PCRE2 pattern analysis, dynamic decoders with JSON output, and allows/white lists

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.3.0 https://github.com/ossec/ossec-hids.git
    # already have the repo? check out this version:
    $ git checkout 3.3.0

    └──▷ USE IT
    Migrate a standard rule from regex-based matching to the new PCRE2 syntax for improved pattern analysis.
    xml copy

    <rule id='1000' level='5'>
      <match_pcre2>failed password</match_pcre2>
    </rule>

    Configure the analysis daemon to support dynamic decoders with a maximum of 50 keys.
    xml copy

    <ossec_config>
      <analysisd>
        <decoder_order_size>50</decoder_order_size>
      </analysisd>
    </ossec_config>

    Build OSSEC using the system's native PCRE2 libraries instead of the bundled version.
    shell copy

    export PCRE2_SYSTEM=yes
    make USE_PRECOMPIDED_SHOWMSG=no

    • Adds pcre2pcre2A widely used open-source regular expression library maintained by the PCRE2 Project, offering Perl-compatible pattern matching that cyber tools embed for fast, expressive text and binary searching., match_pcre2, prematch_pcre2, srcgeoip_pcre2, dstgeoip_pcre2, srcport_pcre2, dstport_pcre2, user_pcre2, url_pcre2, id_pcre2, status_pcre2, hostname_pcre2, and extra_data_pcre2 XML tags to replace regex in rules
    • Adds support for dynamic decoders with user-defined keys, exposed in JSON output
    • Adds analysisd.decoder_order_size internal option to define the maximum number of keys allowed in a single dynamic decoder
    • Enables building with native PCRE2 packages via the PCRE2_SYSTEM=yes environment variable
    • Switches white lists to allow lists in active-response configuration

    5 details in Everything

16. 3.2.0 Feb 5, 2019 · release notes

    OSSEC HIDS 3.2.0 adds JSON output to CLI tools, native audit.log parsing, archives.json support, and Solaris CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. rootchecks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.0 https://github.com/ossec/ossec-hids.git
    # already have the repo? check out this version:
    $ git checkout 3.2.0

    • Add -j flag to agent_control, syscheck_control, and rootcheck_control to produce JSON output
    • Add <log_format>audit</log_format> setting for native audit.log support in configuration files
    • Enable archives.json output via <logall_json>yes</logall_json> in ossec.conf for archives.log
    • Add -F <sec> and -d modifiers to manage_agents -a command for agent IP conflict handling during registration
    • Add Solaris 11 CIS compliance checks to the rootcheck engine

    5 details in Everything

17. 3.1.0 Oct 12, 2018 · release notes

    OSSEC HIDS 3.1.0 adds -f foreground flag to ossec-authd, Dnsmasq decoding, and new CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline./rootcheck coverage.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.0 https://github.com/ossec/ossec-hids.git
    # already have the repo? check out this version:
    $ git checkout 3.1.0

    └──▷ TRY IT
    Run the authd daemon in the foreground to debug connection issues or integrate with process managers.
    copy

    $ ossec-authd -f

    • Adds -f (foreground) flag support to ossec-authd for daemon control
    • Adds basic support for Dnsmasq decoding
    • Adds rootchecks for Debian 7/8, Windows 10 Enterprise, and Windows Server 2016/2012 R2 via new CIS-aligned configuration files
    • Adds linux_usbdetect_rules.xml, ms1016_usbdetect_rules.xml, ms_firewall_rules.xml, and ms_ipsec_rules for USB detection and Microsoft firewall/IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. monitoring

    4 details in Everything

18. 3.0.0 Jul 17, 2018 · release notes

    OSSEC HIDS 3.0.0 adds Slack/PagerDuty integration, SQLite syscheck, GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services., and more.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.0 https://github.com/ossec/ossec-hids.git
    # already have the repo? check out this version:
    $ git checkout 3.0.0

    • Adds PagerDuty active response action for automated incident triggering.
    • Enables GeoIP support in rules (different_srcgeoip) and JSON output via analysisd.geoip_jsonout config key.
    • Adds SQLite database support for the syscheck file integrity monitoring subsystem.
    • Adds Slack integration capability via the ossec-slack script.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The rule token different_geoip is renamed to different_srcgeoip.
19. 2.9.3 Dec 23, 2017 · release notes

    OSSEC HIDS 2.9.3 adds NSD/Owncloud/ProxMox/PSAD detection and filename attribute in decoders/responses

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.9.3 https://github.com/ossec/ossec-hids.git
    # already have the repo? check out this version:
    $ git checkout 2.9.3

    • Adds NSD Rules and Decoders for Network Security Monitoring event detection
    • Adds Owncloud Rules and Decoders for file sync server activity detection
    • Adds ProxMox Rules and Decoders for virtualization hypervisor events
    • Adds PSAD Rules and Decoders for port scan detector log parsing
    • Allows the filename attribute in decoders and active response configurations via PR #915

    5 details in Everything

20. 2.9.2 Aug 9, 2017 · release notes

    OSSEC HIDS 2.9.2 adds decoders and rules for OpenBDS, Exim, Dovecot, Chrome Remote Desktop, Netscreen, and OpenBSD.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.9.2 https://github.com/ossec/ossec-hids.git
    # already have the repo? check out this version:
    $ git checkout 2.9.2

    • Adds OpenBDS decoder to detect OpenBDS service logs
    • Adds Exim decoder to parse Exim mail server logs
    • Adds new Dovecot Rules for IMAP/POP3 authentication events
    • Adds new Exim Rules for email server activity
    • Adds Chrome Remote Desktop Rules for remote session logging

    +2 more show less

    • Adds Netscreen Firewall Rules for firewall log analysis
    • Adds OpenBSD rules for OpenBSD system auditing

    7 details in Everything

21. 2.9.1 Jun 19, 2017 · release notes

    OSSEC HIDS 2.9.1 adds GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. lookups in Groups/Events and updates rootcheck rules

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.9.1 https://github.com/ossec/ossec-hids.git
    # already have the repo? check out this version:
    $ git checkout 2.9.1

    • Implements GeoIP checks in Groups and Events
    • Updated rootcheck audit db's

    2 details in Everything

22. 2.9.0 Feb 9, 2017 · release notes

    OSSEC HIDS 2.9.0 adds ZeroMQZeroMQA messaging library that provides socket-like abstractions for async message passing over TCP, IPC, or in-process transports, letting tools wire together distributed components without a dedicated message broker. and JSON alert output, Slack active response, and configurable nodiff for syscheck alerts.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.9.0 https://github.com/ossec/ossec-hids.git
    # already have the repo? check out this version:
    $ git checkout 2.9.0

    └──▷ HOW TO FIND IT
    Configure OSSEC to output alerts in JSON format instead of the default text/XML.
    📍<output>json</output>
    Configure OSSEC to send alerts via ZeroMQ instead of traditional mail or file logging.
    📍<output>zeromq</output>
    Configure a local MTA binary for sending mail alerts, bypassing network SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. to handle encryption locally.
    📍<smtp_server>/usr/sbin/sendmail -t</smtp_server>
    Configure syscheck to report file modifications but exclude the file contents (diff) for sensitive files.
    📍<nodiff>/etc/shadow</nodiff>
    Add a Slack integration to the active responses configuration to notify on specific alerts.
    📍<command>slack</command> <level>7</level> <location>local</location> <alert_format>json</alert_format>
    • Add support for the nodiff option in ossec.conf to exclude file content from alerts on modified files
    • Add slack notification support to Active Response
    • Allow <smtp_server> field in ossec.conf to designate a local binary path
    • Adds email_reply_to configuration support for setting the Reply-To header in mail alerts

    4 details in Everything

23. v2.7 Feb 24, 2014 · release notes

    OSSEC HIDS v2.7 adds hybrid server-agent mode, manage_agents bulk keygen, GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. correlation, and JSON/Splunk syslog output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.7 https://github.com/ossec/ossec-hids.git
    # already have the repo? check out this version:
    $ git checkout v2.7

    └──▷ USE IT
    Bulk-import client keys from a file using the new manage_agents flag.
    shell copy

    manage_agents -f /path/to/clients.txt

    Configure individual rootcheck tasks in ossec.conf to improve efficiency.
    config copy

    <ossec_config>
      <rootcheck>
        <disabled>yes</disabled>
        <check_pids>no</check_pids>
        <check_ports>yes</check_ports>
      </rootcheck>
    </ossec_config>

    Set syslog output format to JSON for modern log aggregation pipelines.
    config copy

    <ossec_config>
      <syslog_output>
        <format>json</format>
      </syslog_output>
    </ossec_config>

    • Adds manage_agents -f option for bulk generation of client keys from an input file
    • Adds hybrid mode to allow the same host to function as both a server and an agent
    • Adds GeoIP lookup support to associate geographical city names with IP addresses in alerts
    • Adds syscheck MD5/SHA1 sum to alerts for third-party file signature checking integration
    • Adds fine-grained configuration control to turn ON/OFF individual rootcheck tasks

    5 details in Everything

24. v2.7.1 Feb 24, 2014 · release notes

    OSSEC v2.7.1 adds configurable agent heartbeat intervals and a custom_alert_output feature for log monitoring.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.7.1 https://github.com/ossec/ossec-hids.git
    # already have the repo? check out this version:
    $ git checkout v2.7.1

    • Make Heartbeat interval configurable in ossec.conf via notify_time and time-reconnect for agents
    • Added new feature custom_alert_output to customize alert output format

    2 details in Everything