https://cybertoolchain.io/tools/ossec-hids New releases and features in OSSEC HIDS, tracked by The Cyber Toolchain. en Mon, 05 Oct 2026 20:19:19 GMT https://github.com/ossec/ossec-hids/releases/tag/4.4.0 https://github.com/ossec/ossec-hids/releases/tag/4.4.0 Mon, 05 Oct 2026 20:19:19 GMT OSSEC 4.4.0 adds Windows FIM attribute/ACL checks, GeoLite2 MMDB GeoIP with IDS rules, and JSON syslog alert forwarding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds opt-in `check_attrs` config key to Windows FIM to alert on Hidden/System/attribute changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds opt-in `check_acl` config key to Windows FIM to alert on NTFS DACL/ACE matrix changes. • Replaces EOL GeoIP Legacy with `libmaxminddb` (GeoLite2 MMDB) for GeoIP lookups in `analysisd`, adding ASN and country enrichment. • Adds GeoIP IDS rules covering multi-country authentication and impossible-travel detection. • Enables `ossec-csyslogd` to forward `analysisd` JSON alerts over syslog with `agent_name` as a first-class field. • Makes `jsonout` remain enabled when the XML tag is omitted, with alert rotation handled by `monitord`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ossec-hids https://github.com/ossec/ossec-hids/releases/tag/4.3.0 https://github.com/ossec/ossec-hids/releases/tag/4.3.0 Tue, 25 Aug 2026 14:05:17 GMT OSSEC 4.3.0 adds FIM maintenance mode, TCP/TLS syslog output, and ModSecurity audit log collection • Adds FIM maintenance mode via `agent_control -M` with subcommands `enable`, `disable`, `status`, and `end` (plus `-u <id>` to target a specific agent), letting syscheck absorb file changes into the baseline without firing integrity alerts; `end` restarts syscheck/rootcheck and clears maintenance after the scan completes. • Adds TCP and optional TLS support to `ossec-csyslogd` `syslog_output` via new config keys `protocol`, `tls`, `tls_verify`, and `tls_ca`, in addition to existing UDP; alert payloads in default, CEF, JSON, and Splunk formats now support up to `OS_MAXSTR` instead of the former 2048-byte limit. • Adds `modsec-audit` localfile format to collect libmodsecurity serial audit logs, plus new decoders and rules for nginx ModSecurity error-log events. • Allows `manage_agents -f -` to bulk-load agents from stdin. • Adds support for `###` trailing comments in CDB list text files. • Uses a dedicated OSSEC iptables chain for firewall-drop active response instead of the default chain. • Adds Postfix SMTP connect-abort detection with escalation by source IP. • Adds matching of Snort `[Drop]` fast alerts in the Snort decoder. • Decodes named client IPs with an optional BIND `@cookie` prefix. • Adds cPanel/cpsrvd decoders and rules. • Adds Windows interactive logon (logon type 2) success detail rule 18262. • Backs up agent state before remove/force-delete and alerts on duplicated IP. • Adds Asterisk IPv6 denied decoder so `srcip` omits square brackets. • Enables Linux compile/link hardening by default (PIE, FORTIFY, stack protector, full RELRO). • Rejects dangerous or ambiguous `syscheck_control` flag combinations such as `-r -u`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ossec-hids https://github.com/ossec/ossec-hids/releases/tag/4.2.0 https://github.com/ossec/ossec-hids/releases/tag/4.2.0 Sun, 02 Aug 2026 21:32:17 GMT OSSEC 4.2.0 adds a multi-threaded analysisd pipeline, rootcheck file-hash enrichment, pthread migration, and a self-contained Windows agent installer. • Adds an always-on multi-threaded analysisd event pipeline for Linux servers, improving analysisd scalability. • Appends MD5, SHA1, and SHA256 hashes of detected rootcheck files to alerts, enriching forensic context. • Migrates manager daemons to pthreads and adds shared thread pool support. • Bundles required MinGW/OpenSSL runtime DLLs in the Windows agent installer, enabling self-contained deployment. • Adds IPv6 key validation via OS_IsValidIP for authd -i keys. • Indicates in alerts when report_changes diffs are truncated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ossec-hids https://github.com/ossec/ossec-hids/releases/tag/4.1.0 https://github.com/ossec/ossec-hids/releases/tag/4.1.0 Wed, 27 May 2026 15:44:58 GMT OSSEC 4.1.0 adds SMTP TLS/auth, IPv6 whitelisting, large file (>2GB) support, and Rocky Linux 9 builds. • Adds SMTP TLS and authentication support to maild and monitord for authenticated email alerting. • Improves IPv6 whitelisting support in install.sh, enabling IPv6 addresses to be excluded from alerting. • Enables large file support (>2GB) in Makefile and hash operations, allowing monitoring of files previously beyond the size limit. • Increases default decoder field limit to 256 to support complex log formats. • Adds support for Rocky Linux 9 as a build and deployment platform. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ossec-hids https://github.com/ossec/ossec-hids/releases/tag/4.0.0 https://github.com/ossec/ossec-hids/releases/tag/4.0.0 Sun, 01 Feb 2026 21:47:15 GMT OSSEC 4.0.0 ships AES encryption by default for agent comms and enables SHA-256 file integrity monitoring out of the box. • Enables AES encryption by default for all agent-server communication, replacing Blowfish as the default cipher. • Enables SHA-256 checksums by default for all syscheck-monitored directories, modernizing file integrity monitoring. Breaking changes: • AES encryption is now the default for agent-server communication; OSSEC 4.0.0 agents are NOT backwards compatible with OSSEC 3.8.0 and older servers — upgrade servers first, or add `<crypto_method>blowfish</crypto_method>` inside `<client>` in the agent's `ossec.conf` to fall back to Blowfish. • SHA-256 is now enabled by default for all monitored directories; installations that cannot support this can disable it by setting `check_sha256sum="no"` on each `<directories>` entry in `<syscheck>`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ossec-hids https://github.com/ossec/ossec-hids/releases/tag/3.8.0 https://github.com/ossec/ossec-hids/releases/tag/3.8.0 Sun, 05 Jan 2025 21:26:37 GMT OSSEC 3.8.0 adds AIX 7.x support, authd privilege separation, and updated rootkit detection. • Adds support for AIX 7.x on POWER architecture (generations 8, 9, and 10). • Enforces chroot and privilege separation for the authd daemon, which now runs as the ossec user by default. • Updates rootkit detection signatures for 1stmile rootkit. Breaking changes: • The authd daemon now runs as the ossec user by default and enforces chrooting — deployments relying on authd running as root or outside a chroot may need reconfiguration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ossec-hids https://github.com/ossec/ossec-hids/releases/tag/3.7.0 https://github.com/ossec/ossec-hids/releases/tag/3.7.0 Mon, 17 Jan 2022 16:06:52 GMT OSSEC HIDS 3.7.0 adds Journald support, active response for nftables, and an AWS WAF analysis script • Adds `active_responses/local_commands/active-response/bin/ossec-aws-waf.sh` to analyze AWS WAF logs. • Adds `active_responses/local_commands/active-response/bin/ossec-nftables.sh` for nftables-based active response. • Adds support for reading and parsing `journald` system logs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ossec-hids