Configuring Host Based Intrusion Detection

Configuring Host Based Intrusion Detection

Overview

Cybersecurity skill for configuring host based intrusion detection. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "configuring host based intrusion detection"
• "Deploying HIDS agents (Wazuh, OSSEC, AIDE) across Windows and Linux endpoints"
• "Configuring file integrity monitoring (FIM) for compliance (PCI DSS 11"
• "Monitoring system configuration changes, rootkit detection, and security policy"

Use this skill when:

• Deploying HIDS agents (Wazuh, OSSEC, AIDE) across Windows and Linux endpoints
• Configuring file integrity monitoring (FIM) for compliance (PCI DSS 11.5, NIST SI-7)
• Monitoring system configuration changes, rootkit detection, and security policy violations
• Integrating HIDS alerts with SIEM platforms for centralized monitoring

Do not use this skill for network-based IDS (Suricata, Snort) or for EDR deployment.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Wazuh server (manager) deployed and accessible from endpoints
• Administrative access to target endpoints
• Network connectivity: agents to Wazuh manager on port 1514 (TCP/UDP) and 1515 (TCP enrollment)
• Wazuh dashboard (OpenSearch Dashboards) for alert visualization
• Understanding of critical files/directories to monitor per OS

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. Define Objectives — Clarify the goals and scope for host based intrusion detection.
2. Gather Resources — Collect tools, data, and access needed for host based intrusion detection.
3. Execute Process — Carry out host based intrusion detection operations methodically.
4. Verify Quality — Check results against acceptance criteria.
5. Document Outcomes — Record findings, decisions, and next steps.

Tools

• Analysis Platform — Data processing and visualization
• Collaboration Tools — Team coordination and knowledge sharing

Process

1. Reconnaissance — Gather target information, identify attack surface, enumerate services
2. Analysis/Exploitation — Execute the technique, analyze results, document findings
3. Reporting — Document IOCs, write findings, provide remediation recommendations

Verification

• All host based intrusion detection procedures executed completely and documented
• Findings validated against multiple data sources
• False positives identified and filtered
• Results documented with evidence and timestamps
• Recommendations provided with risk-based prioritization

Anti-Rationalization Table