Which IDS is described as a host-based open-source IDS?

Which IDS is described as a host-based open-source IDS?

• A. Snort
• B. OSSEC
• C. Sguil
• D. Protocol Anomaly Detection

Answer: (B)

The concept being tested is distinguishing host-based from network-based intrusion detection systems and identifying an open-source example that runs on the host. OSSEC fits as the host-based IDS because it operates on individual machines to monitor local activity—such as system logs, file integrity, and rootkit indicators—often using agents on each host reporting to a central manager. It is open-source and widely used as a HIDS, making it the best match for a host-based open-source description. Snort, by contrast, is a network-based IDS that analyzes traffic across a network segment. Sguil is a security monitoring console that integrates data from network sensors like Snort rather than being a host-based IDS itself. Protocol Anomaly Detection describes a method or category, not a specific host-based open-source IDS.

The concept being tested is distinguishing host-based from network-based intrusion detection systems and identifying an open-source example that runs on the host.

OSSEC fits as the host-based IDS because it operates on individual machines to monitor local activity—such as system logs, file integrity, and rootkit indicators—often using agents on each host reporting to a central manager. It is open-source and widely used as a HIDS, making it the best match for a host-based open-source description.

Snort, by contrast, is a network-based IDS that analyzes traffic across a network segment. Sguil is a security monitoring console that integrates data from network sensors like Snort rather than being a host-based IDS itself. Protocol Anomaly Detection describes a method or category, not a specific host-based open-source IDS.