OSSEC is described as which of the following?

OSSEC is described as which of the following?

• A. Network-based IDS
• B. Host-based open-source IDS
• C. Sguil
• D. Snort

Answer: (B)

OSSEC is a host-based open-source intrusion detection system. It runs on each protected machine as an agent that watches local logs, performs file integrity checks, and detects potential rootkits, raising alerts when something looks suspicious. Alerts are collected by a central manager that aggregates events and can trigger active responses on the host. Because it focuses on monitoring the individual endpoint rather than network traffic, OSSEC is a host-based solution, unlike network-based IDS options that analyze packets traversing the network.

OSSEC is a host-based open-source intrusion detection system. It runs on each protected machine as an agent that watches local logs, performs file integrity checks, and detects potential rootkits, raising alerts when something looks suspicious. Alerts are collected by a central manager that aggregates events and can trigger active responses on the host. Because it focuses on monitoring the individual endpoint rather than network traffic, OSSEC is a host-based solution, unlike network-based IDS options that analyze packets traversing the network.