search

cdpxe / KSPIDS

A kernel-based IDS for Linux. KSPIDS monitors especially system calls.
http://www.wendzel.de/projects/
GNU General Public License v3.0
2 stars 1 forks source link

Question about usage #1

Open jhjacobs81 opened 4 years ago

jhjacobs81 commented 4 years ago

So, if i wanted to build a system based on the CIS recommendations, this would (eventually) allow me to dispose of the OSSEC HIDS?

Or am i missing the point of this software?

Looks damn interesting though ;-)

cdpxe commented 4 years ago

There are many different types of HIDS, e.g. filesystem IDS, which KSPIDS does not provide as it works on a user/process basis. They complement each other. For this reason, I cannot suggest to replace but rather combine different types of HIDS.