A HIDS (host-based intrusion detection system) for verifying the integrity of a system.

Features

  • checks the integrity of system’s files with a list of rules;
  • checks the output of commands (iptables, …);
  • possibity to use RSA to sign to check the integrity of its database;
  • alerts are written in the logs of the system;
  • alerts can be sent via email to a list of users;
  • alerts can be sent on IRC channels through the irker IRC client (which should be running as a daemon);
  • verify files with Hashlookup, Pandora, MISP and YARA;
  • possibility to export the database in a Bloom or a Cuckoo filter.

pyHIDS is under GPLv3 license.

Homepage: https://github.com/cedricbonhomme/pyHIDS