[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE4VNRYE0R39RPHSYY2EX6":3,"skill-same:01M6AE4VNRYE0R39RPHSYY2EX6":120},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":61,"commitSha":62,"skillDirectory":63,"forksCount":64,"repositoryHtmlUrl":65,"repositoryHomepageUrl":66,"ownerHtmlUrl":67,"ownerBlogUrl":68,"ownerDescription":69,"updatedAt":70,"install":71,"resources":84},"01M6AE4VNRYE0R39RPHSYY2EX6","configuring-host-based-intrusion-detection",null,"Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations. Use when deploying OSSEC, Wazuh, or AIDE for endpoint monitoring, building file integrity monitoring (FIM) policies, or meeting compliance requirements for change detection. Activates for requests involving HIDS configuration, file integrity monitoring, OSSEC\u002FWazuh deployment, or host-based detection.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-host-based-intrusion-detection\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"configuring host based intrusion detection","compliance","file-integrity-monitoring","OSSEC","Wazuh","endpoint","endpoint-security","HIDS","intrusion-detection","security","monitoring","file","deployment","monitor","pr","change","cybersecurity","2026-11-10 10:12:30",false,"---\nname: configuring-host-based-intrusion-detection\ndescription: 'Configures host-based intrusion detection systems (HIDS) to monitor\n  endpoint file integrity, system calls, and configuration changes for security violations.\n  Use when deploying OSSEC, Wazuh, or AIDE for endpoint monitoring, building file\n  integrity monitoring (FIM) policies, or meeting compliance requirements for change\n  detection. Activates for requests involving HIDS configuration, file integrity monitoring,\n  OSSEC\u002FWazuh deployment, or host-based detection.\n\n  '\ndomain: cybersecurity\nsubdomain: endpoint-security\ntags:\n- endpoint\n- HIDS\n- Wazuh\n- OSSEC\n- file-integrity-monitoring\n- intrusion-detection\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.PS-02\n- DE.CM-01\n- PR.IR-01\nmitre_attack:\n- T1059\n- T1543\n- T1547\n- T1070\n- T1055\n---\n# Configuring Host-Based Intrusion Detection\n\n## When to Use\n\nUse this skill when:\n- Deploying HIDS agents (Wazuh, OSSEC, AIDE) across Windows and Linux endpoints\n- Configuring file integrity monitoring (FIM) for compliance (PCI DSS 11.5, NIST SI-7)\n- Monitoring system configuration changes, rootkit detection, and security policy violations\n- Integrating HIDS alerts with SIEM platforms for centralized monitoring\n\n**Do not use** this skill for network-based IDS (Suricata, Snort) or for EDR deployment.\n\n## Prerequisites\n\n- Wazuh server (manager) deployed and accessible from endpoints\n- Administrative access to target endpoints\n- Network connectivity: agents to Wazuh manager on port 1514 (TCP\u002FUDP) and 1515 (TCP enrollment)\n- Wazuh dashboard (OpenSearch Dashboards) for alert visualization\n- Understanding of critical files\u002Fdirectories to monitor per OS\n\n## Workflow\n\n### Step 1: Install Wazuh Agent\n\n**Windows**:\n```powershell\n# Download and install Wazuh agent\nInvoke-WebRequest -Uri \"https:\u002F\u002Fpackages.wazuh.com\u002F4.x\u002Fwindows\u002Fwazuh-agent-4.9.0-1.msi\" `\n  -OutFile \"wazuh-agent.msi\"\nmsiexec \u002Fi wazuh-agent.msi \u002Fq WAZUH_MANAGER=\"wazuh-manager.corp.com\" `\n  WAZUH_REGISTRATION_SERVER=\"wazuh-manager.corp.com\" WAZUH_AGENT_GROUP=\"windows-workstations\"\nnet start WazuhSvc\n```\n\n**Linux (Debian\u002FUbuntu)**:\n```bash\ncurl -s https:\u002F\u002Fpackages.wazuh.com\u002Fkey\u002FGPG-KEY-WAZUH | gpg --dearmor -o \u002Fusr\u002Fshare\u002Fkeyrings\u002Fwazuh.gpg\necho \"deb [signed-by=\u002Fusr\u002Fshare\u002Fkeyrings\u002Fwazuh.gpg] https:\u002F\u002Fpackages.wazuh.com\u002F4.x\u002Fapt\u002F stable main\" \\\n  > \u002Fetc\u002Fapt\u002Fsources.list.d\u002Fwazuh.list\napt-get update && apt-get install wazuh-agent -y\nsed -i 's\u002FMANAGER_IP\u002Fwazuh-manager.corp.com\u002F' \u002Fvar\u002Fossec\u002Fetc\u002Fossec.conf\nsystemctl daemon-reload && systemctl enable --now wazuh-agent\n```\n\n### Step 2: Configure File Integrity Monitoring (FIM)\n\nEdit agent configuration (`\u002Fvar\u002Fossec\u002Fetc\u002Fossec.conf` or `C:\\Program Files (x86)\\ossec-agent\\ossec.conf`):\n\n```xml\n\u003Csyscheck>\n  \u003C!-- Scan frequency: every 12 hours -->\n  \u003Cfrequency>43200\u003C\u002Ffrequency>\n  \u003Cscan_on_start>yes\u003C\u002Fscan_on_start>\n  \u003Calert_new_files>yes\u003C\u002Falert_new_files>\n\n  \u003C!-- Linux critical directories -->\n  \u003Cdirectories check_all=\"yes\" realtime=\"yes\">\u002Fetc\u003C\u002Fdirectories>\n  \u003Cdirectories check_all=\"yes\" realtime=\"yes\">\u002Fusr\u002Fbin\u003C\u002Fdirectories>\n  \u003Cdirectories check_all=\"yes\" realtime=\"yes\">\u002Fusr\u002Fsbin\u003C\u002Fdirectories>\n  \u003Cdirectories check_all=\"yes\" realtime=\"yes\">\u002Fbin\u003C\u002Fdirectories>\n  \u003Cdirectories check_all=\"yes\" realtime=\"yes\">\u002Fsbin\u003C\u002Fdirectories>\n  \u003Cdirectories check_all=\"yes\">\u002Fboot\u003C\u002Fdirectories>\n\n  \u003C!-- Windows critical directories -->\n  \u003Cdirectories check_all=\"yes\" realtime=\"yes\">C:\\Windows\\System32\u003C\u002Fdirectories>\n  \u003Cdirectories check_all=\"yes\" realtime=\"yes\">C:\\Windows\\SysWOW64\u003C\u002Fdirectories>\n  \u003Cdirectories check_all=\"yes\" realtime=\"yes\">%PROGRAMFILES%\u003C\u002Fdirectories>\n\n  \u003C!-- Windows registry monitoring -->\n  \u003Cwindows_registry>HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\u003C\u002Fwindows_registry>\n  \u003Cwindows_registry>HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\u003C\u002Fwindows_registry>\n  \u003Cwindows_registry>HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\u003C\u002Fwindows_registry>\n\n  \u003C!-- Ignore frequently changing files -->\n  \u003Cignore>\u002Fetc\u002Fmtab\u003C\u002Fignore>\n  \u003Cignore>\u002Fetc\u002Fresolv.conf\u003C\u002Fignore>\n  \u003Cignore type=\"sregex\">.log$\u003C\u002Fignore>\n\u003C\u002Fsyscheck>\n```\n\n### Step 3: Configure Rootkit Detection\n\n```xml\n\u003Crootcheck>\n  \u003Cdisabled>no\u003C\u002Fdisabled>\n  \u003Cfrequency>43200\u003C\u002Ffrequency>\n  \u003Crootkit_files>\u002Fvar\u002Fossec\u002Fetc\u002Fshared\u002Frootkit_files.txt\u003C\u002Frootkit_files>\n  \u003Crootkit_trojans>\u002Fvar\u002Fossec\u002Fetc\u002Fshared\u002Frootkit_trojans.txt\u003C\u002Frootkit_trojans>\n  \u003Csystem_audit>\u002Fvar\u002Fossec\u002Fetc\u002Fshared\u002Fsystem_audit_rcl.txt\u003C\u002Fsystem_audit>\n  \u003Ccheck_dev>yes\u003C\u002Fcheck_dev>\n  \u003Ccheck_files>yes\u003C\u002Fcheck_files>\n  \u003Ccheck_if>yes\u003C\u002Fcheck_if>\n  \u003Ccheck_pids>yes\u003C\u002Fcheck_pids>\n  \u003Ccheck_ports>yes\u003C\u002Fcheck_ports>\n  \u003Ccheck_sys>yes\u003C\u002Fcheck_sys>\n  \u003Ccheck_trojans>yes\u003C\u002Fcheck_trojans>\n  \u003Ccheck_unixaudit>yes\u003C\u002Fcheck_unixaudit>\n\u003C\u002Frootcheck>\n```\n\n### Step 4: Configure Log Analysis Rules\n\n```xml\n\u003C!-- Custom rules in \u002Fvar\u002Fossec\u002Fetc\u002Frules\u002Flocal_rules.xml -->\n\u003Cgroup name=\"local,syscheck,\">\n  \u003C!-- Alert on critical binary modifications -->\n  \u003Crule id=\"100001\" level=\"12\">\n    \u003Cif_sid>550\u003C\u002Fif_sid>\n    \u003Cmatch>\u002Fusr\u002Fbin\u002F|\u002Fusr\u002Fsbin\u002F|\u002Fbin\u002F|\u002Fsbin\u002F\u003C\u002Fmatch>\n    \u003Cdescription>Critical system binary modified: $(file)\u003C\u002Fdescription>\n    \u003Cgroup>syscheck,pci_dss_11.5,\u003C\u002Fgroup>\n  \u003C\u002Frule>\n\n  \u003C!-- Alert on new executable in temp directories -->\n  \u003Crule id=\"100002\" level=\"10\">\n    \u003Cif_sid>554\u003C\u002Fif_sid>\n    \u003Cmatch>\u002Ftmp\u002F|\u002Fvar\u002Ftmp\u002F\u003C\u002Fmatch>\n    \u003Cdescription>New file created in temp directory: $(file)\u003C\u002Fdescription>\n    \u003Cgroup>syscheck,malware,\u003C\u002Fgroup>\n  \u003C\u002Frule>\n\n  \u003C!-- Alert on SSH configuration changes -->\n  \u003Crule id=\"100003\" level=\"10\">\n    \u003Cif_sid>550\u003C\u002Fif_sid>\n    \u003Cmatch>\u002Fetc\u002Fssh\u002Fsshd_config\u003C\u002Fmatch>\n    \u003Cdescription>SSH configuration modified\u003C\u002Fdescription>\n    \u003Cgroup>syscheck,authentication,\u003C\u002Fgroup>\n  \u003C\u002Frule>\n\u003C\u002Fgroup>\n```\n\n### Step 5: Configure Active Response\n\n```xml\n\u003C!-- Auto-block IP after repeated authentication failures -->\n\u003Cactive-response>\n  \u003Ccommand>firewall-drop\u003C\u002Fcommand>\n  \u003Clocation>local\u003C\u002Flocation>\n  \u003Crules_id>5712\u003C\u002Frules_id>\n  \u003Ctimeout>600\u003C\u002Ftimeout>\n\u003C\u002Factive-response>\n\n\u003C!-- Disable account after brute force detection -->\n\u003Cactive-response>\n  \u003Cdisabled>no\u003C\u002Fdisabled>\n  \u003Ccommand>disable-account\u003C\u002Fcommand>\n  \u003Clocation>local\u003C\u002Flocation>\n  \u003Crules_id>100100\u003C\u002Frules_id>\n  \u003Ctimeout>3600\u003C\u002Ftimeout>\n\u003C\u002Factive-response>\n```\n\n### Step 6: Integrate with SIEM\n\n```\n# Wazuh to Splunk via Filebeat\n# Edit \u002Fetc\u002Ffilebeat\u002Ffilebeat.yml:\nfilebeat.inputs:\n  - type: log\n    paths:\n      - \u002Fvar\u002Fossec\u002Flogs\u002Falerts\u002Falerts.json\n    json.keys_under_root: true\noutput.elasticsearch:\n  hosts: [\"https:\u002F\u002Fsplunk-hec:8088\"]\n\n# Wazuh to Elastic via direct integration\n# Wazuh indexer feeds directly into OpenSearch\u002FElasticsearch\n# Dashboard: https:\u002F\u002Fwazuh-dashboard:5601\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **HIDS** | Host-based Intrusion Detection System; monitors individual endpoints for malicious activity |\n| **FIM** | File Integrity Monitoring; detects unauthorized changes to files by comparing cryptographic hashes |\n| **Syscheck** | Wazuh\u002FOSSEC module for file integrity monitoring and registry monitoring |\n| **Rootcheck** | Wazuh\u002FOSSEC module for rootkit and malware detection |\n| **Active Response** | Automated defensive action triggered by HIDS alert (IP block, account disable) |\n| **CDB List** | Constant Database list used for custom lookups in Wazuh rules |\n\n## Tools & Systems\n\n- **Wazuh**: Open-source HIDS platform (fork of OSSEC) with manager, agent, and dashboard\n- **OSSEC**: Original open-source HIDS (predecessor to Wazuh)\n- **AIDE (Advanced Intrusion Detection Environment)**: Standalone file integrity checker for Linux\n- **Tripwire**: Commercial file integrity monitoring solution\n- **Samhain**: Open-source HIDS focused on file integrity and log monitoring\n\n## Common Pitfalls\n\n- **Monitoring too many directories**: FIM on entire filesystems generates excessive alerts. Focus on critical system binaries, configuration files, and web roots.\n- **Not excluding noisy files**: Frequently changing files (logs, temp, caches) generate false positive FIM alerts. Maintain exclusion lists.\n- **Ignoring baseline establishment**: First FIM scan creates a baseline. Changes detected before baseline stabilization are noise, not threats. Allow 48 hours for baseline.\n- **Active response without testing**: Auto-blocking IPs or disabling accounts can cause outages. Test active response rules in a non-production environment first.\n- **Agent enrollment failures**: Agents must successfully enroll with the manager before monitoring begins. Verify firewall rules allow port 1514 and 1515 traffic.\n","# Configuring Host-Based Intrusion Detection\n\n## When to Use\n\nUse this skill when:\n- Deploying HIDS agents (Wazuh, OSSEC, AIDE) across Windows and Linux endpoints\n- Configuring file integrity monitoring (FIM) for compliance (PCI DSS 11.5, NIST SI-7)\n- Monitoring system configuration changes, rootkit detection, and security policy violations\n- Integrating HIDS alerts with SIEM platforms for centralized monitoring\n\n**Do not use** this skill for network-based IDS (Suricata, Snort) or for EDR deployment.\n\n## Prerequisites\n\n- Wazuh server (manager) deployed and accessible from endpoints\n- Administrative access to target endpoints\n- Network connectivity: agents to Wazuh manager on port 1514 (TCP\u002FUDP) and 1515 (TCP enrollment)\n- Wazuh dashboard (OpenSearch Dashboards) for alert visualization\n- Understanding of critical files\u002Fdirectories to monitor per OS\n\n## Workflow\n\n### Step 1: Install Wazuh Agent\n\n**Windows**:\n```powershell\n# Download and install Wazuh agent\nInvoke-WebRequest -Uri \"https:\u002F\u002Fpackages.wazuh.com\u002F4.x\u002Fwindows\u002Fwazuh-agent-4.9.0-1.msi\" `\n  -OutFile \"wazuh-agent.msi\"\nmsiexec \u002Fi wazuh-agent.msi \u002Fq WAZUH_MANAGER=\"wazuh-manager.corp.com\" `\n  WAZUH_REGISTRATION_SERVER=\"wazuh-manager.corp.com\" WAZUH_AGENT_GROUP=\"windows-workstations\"\nnet start WazuhSvc\n```\n\n**Linux (Debian\u002FUbuntu)**:\n```bash\ncurl -s https:\u002F\u002Fpackages.wazuh.com\u002Fkey\u002FGPG-KEY-WAZUH | gpg --dearmor -o \u002Fusr\u002Fshare\u002Fkeyrings\u002Fwazuh.gpg\necho \"deb [signed-by=\u002Fusr\u002Fshare\u002Fkeyrings\u002Fwazuh.gpg] https:\u002F\u002Fpackages.wazuh.com\u002F4.x\u002Fapt\u002F stable main\" \\\n  > \u002Fetc\u002Fapt\u002Fsources.list.d\u002Fwazuh.list\napt-get update && apt-get install wazuh-agent -y\nsed -i 's\u002FMANAGER_IP\u002Fwazuh-manager.corp.com\u002F' \u002Fvar\u002Fossec\u002Fetc\u002Fossec.conf\nsystemctl daemon-reload && systemctl enable --now wazuh-agent\n```\n\n### Step 2: Configure File Integrity Monitoring (FIM)\n\nEdit agent configuration (`\u002Fvar\u002Fossec\u002Fetc\u002Fossec.conf` or `C:\\Program Files (x86)\\ossec-agent\\ossec.conf`):\n\n```xml\n\u003Csyscheck>\n  \u003C!-- Scan frequency: every 12 hours -->\n  \u003Cfrequency>43200\u003C\u002Ffrequency>\n  \u003Cscan_on_start>yes\u003C\u002Fscan_on_start>\n  \u003Calert_new_files>yes\u003C\u002Falert_new_files>\n\n  \u003C!-- Linux critical directories -->\n  \u003Cdirectories check_all=\"yes\" realtime=\"yes\">\u002Fetc\u003C\u002Fdirectories>\n  \u003Cdirectories check_all=\"yes\" realtime=\"yes\">\u002Fusr\u002Fbin\u003C\u002Fdirectories>\n  \u003Cdirectories check_all=\"yes\" realtime=\"yes\">\u002Fusr\u002Fsbin\u003C\u002Fdirectories>\n  \u003Cdirectories check_all=\"yes\" realtime=\"yes\">\u002Fbin\u003C\u002Fdirectories>\n  \u003Cdirectories check_all=\"yes\" realtime=\"yes\">\u002Fsbin\u003C\u002Fdirectories>\n  \u003Cdirectories check_all=\"yes\">\u002Fboot\u003C\u002Fdirectories>\n\n  \u003C!-- Windows critical directories -->\n  \u003Cdirectories check_all=\"yes\" realtime=\"yes\">C:\\Windows\\System32\u003C\u002Fdirectories>\n  \u003Cdirectories check_all=\"yes\" realtime=\"yes\">C:\\Windows\\SysWOW64\u003C\u002Fdirectories>\n  \u003Cdirectories check_all=\"yes\" realtime=\"yes\">%PROGRAMFILES%\u003C\u002Fdirectories>\n\n  \u003C!-- Windows registry monitoring -->\n  \u003Cwindows_registry>HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\u003C\u002Fwindows_registry>\n  \u003Cwindows_registry>HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\u003C\u002Fwindows_registry>\n  \u003Cwindows_registry>HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\u003C\u002Fwindows_registry>\n\n  \u003C!-- Ignore frequently changing files -->\n  \u003Cignore>\u002Fetc\u002Fmtab\u003C\u002Fignore>\n  \u003Cignore>\u002Fetc\u002Fresolv.conf\u003C\u002Fignore>\n  \u003Cignore type=\"sregex\">.log$\u003C\u002Fignore>\n\u003C\u002Fsyscheck>\n```\n\n### Step 3: Configure Rootkit Detection\n\n```xml\n\u003Crootcheck>\n  \u003Cdisabled>no\u003C\u002Fdisabled>\n  \u003Cfrequency>43200\u003C\u002Ffrequency>\n  \u003Crootkit_files>\u002Fvar\u002Fossec\u002Fetc\u002Fshared\u002Frootkit_files.txt\u003C\u002Frootkit_files>\n  \u003Crootkit_trojans>\u002Fvar\u002Fossec\u002Fetc\u002Fshared\u002Frootkit_trojans.txt\u003C\u002Frootkit_trojans>\n  \u003Csystem_audit>\u002Fvar\u002Fossec\u002Fetc\u002Fshared\u002Fsystem_audit_rcl.txt\u003C\u002Fsystem_audit>\n  \u003Ccheck_dev>yes\u003C\u002Fcheck_dev>\n  \u003Ccheck_files>yes\u003C\u002Fcheck_files>\n  \u003Ccheck_if>yes\u003C\u002Fcheck_if>\n  \u003Ccheck_pids>yes\u003C\u002Fcheck_pids>\n  \u003Ccheck_ports>yes\u003C\u002Fcheck_ports>\n  \u003Ccheck_sys>yes\u003C\u002Fcheck_sys>\n  \u003Ccheck_trojans>yes\u003C\u002Fcheck_trojans>\n  \u003Ccheck_unixaudit>yes\u003C\u002Fcheck_unixaudit>\n\u003C\u002Frootcheck>\n```\n\n### Step 4: Configure Log Analysis Rules\n\n```xml\n\u003C!-- Custom rules in \u002Fvar\u002Fossec\u002Fetc\u002Frules\u002Flocal_rules.xml -->\n\u003Cgroup name=\"local,syscheck,\">\n  \u003C!-- Alert on critical binary modifications -->\n  \u003Crule id=\"100001\" level=\"12\">\n    \u003Cif_sid>550\u003C\u002Fif_sid>\n    \u003Cmatch>\u002Fusr\u002Fbin\u002F|\u002Fusr\u002Fsbin\u002F|\u002Fbin\u002F|\u002Fsbin\u002F\u003C\u002Fmatch>\n    \u003Cdescription>Critical system binary modified: $(file)\u003C\u002Fdescription>\n    \u003Cgroup>syscheck,pci_dss_11.5,\u003C\u002Fgroup>\n  \u003C\u002Frule>\n\n  \u003C!-- Alert on new executable in temp directories -->\n  \u003Crule id=\"100002\" level=\"10\">\n    \u003Cif_sid>554\u003C\u002Fif_sid>\n    \u003Cmatch>\u002Ftmp\u002F|\u002Fvar\u002Ftmp\u002F\u003C\u002Fmatch>\n    \u003Cdescription>New file created in temp directory: $(file)\u003C\u002Fdescription>\n    \u003Cgroup>syscheck,malware,\u003C\u002Fgroup>\n  \u003C\u002Frule>\n\n  \u003C!-- Alert on SSH configuration changes -->\n  \u003Crule id=\"100003\" level=\"10\">\n    \u003Cif_sid>550\u003C\u002Fif_sid>\n    \u003Cmatch>\u002Fetc\u002Fssh\u002Fsshd_config\u003C\u002Fmatch>\n    \u003Cdescription>SSH configuration modified\u003C\u002Fdescription>\n    \u003Cgroup>syscheck,authentication,\u003C\u002Fgroup>\n  \u003C\u002Frule>\n\u003C\u002Fgroup>\n```\n\n### Step 5: Configure Active Response\n\n```xml\n\u003C!-- Auto-block IP after repeated authentication failures -->\n\u003Cactive-response>\n  \u003Ccommand>firewall-drop\u003C\u002Fcommand>\n  \u003Clocation>local\u003C\u002Flocation>\n  \u003Crules_id>5712\u003C\u002Frules_id>\n  \u003Ctimeout>600\u003C\u002Ftimeout>\n\u003C\u002Factive-response>\n\n\u003C!-- Disable account after brute force detection -->\n\u003Cactive-response>\n  \u003Cdisabled>no\u003C\u002Fdisabled>\n  \u003Ccommand>disable-account\u003C\u002Fcommand>\n  \u003Clocation>local\u003C\u002Flocation>\n  \u003Crules_id>100100\u003C\u002Frules_id>\n  \u003Ctimeout>3600\u003C\u002Ftimeout>\n\u003C\u002Factive-response>\n```\n\n### Step 6: Integrate with SIEM\n\n```\n# Wazuh to Splunk via Filebeat\n# Edit \u002Fetc\u002Ffilebeat\u002Ffilebeat.yml:\nfilebeat.inputs:\n  - type: log\n    paths:\n      - \u002Fvar\u002Fossec\u002Flogs\u002Falerts\u002Falerts.json\n    json.keys_under_root: true\noutput.elasticsearch:\n  hosts: [\"https:\u002F\u002Fsplunk-hec:8088\"]\n\n# Wazuh to Elastic via direct integration\n# Wazuh indexer feeds directly into OpenSearch\u002FElasticsearch\n# Dashboard: https:\u002F\u002Fwazuh-dashboard:5601\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **HIDS** | Host-based Intrusion Detection System; monitors individual endpoints for malicious activity |\n| **FIM** | File Integrity Monitoring; detects unauthorized changes to files by comparing cryptographic hashes |\n| **Syscheck** | Wazuh\u002FOSSEC module for file integrity monitoring and registry monitoring |\n| **Rootcheck** | Wazuh\u002FOSSEC module for rootkit and malware detection |\n| **Active Response** | Automated defensive action triggered by HIDS alert (IP block, account disable) |\n| **CDB List** | Constant Database list used for custom lookups in Wazuh rules |\n\n## Tools & Systems\n\n- **Wazuh**: Open-source HIDS platform (fork of OSSEC) with manager, agent, and dashboard\n- **OSSEC**: Original open-source HIDS (predecessor to Wazuh)\n- **AIDE (Advanced Intrusion Detection Environment)**: Standalone file integrity checker for Linux\n- **Tripwire**: Commercial file integrity monitoring solution\n- **Samhain**: Open-source HIDS focused on file integrity and log monitoring\n\n## Common Pitfalls\n\n- **Monitoring too many directories**: FIM on entire filesystems generates excessive alerts. Focus on critical system binaries, configuration files, and web roots.\n- **Not excluding noisy files**: Frequently changing files (logs, temp, caches) generate false positive FIM alerts. Maintain exclusion lists.\n- **Ignoring baseline establishment**: First FIM scan creates a baseline. Changes detected before baseline stabilization are noise, not threats. Allow 48 hours for baseline.\n- **Active response without testing**: Auto-blocking IPs or disabling accounts can cause outages. Test active response rules in a non-production environment first.\n- **Agent enrollment failures**: Agents must successfully enroll with the manager before monitoring begins. Verify firewall rules allow port 1514 and 1515 traffic.\n",{"name":5,"tags":46,"author":47,"domain":40,"license":15,"version":48,"nist_csf":49,"subdomain":30,"description":54,"mitre_attack":55},[29,31,28,27,26,32],"mahipal","1.0.0",[50,51,52,53],"PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01","Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations. Use when deploying OSSEC, Wazuh, or AIDE for endpoint monitoring, building file integrity monitoring (FIM) policies, or meeting compliance requirements for change detection. Activates for requests involving HIDS configuration, file integrity monitoring, OSSEC\u002FWazuh deployment, or host-based detection.\n",[56,57,58,59,60],"T1059","T1543","T1547","T1070","T1055","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fconfiguring-host-based-intrusion-detection",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill configuring-host-based-intrusion-detection",{"tool":77,"command":78},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill configuring-host-based-intrusion-detection",{"tool":80,"command":81},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill configuring-host-based-intrusion-detection","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-host-based-intrusion-detection\u002FSKILL.md",true,[85,91,96,102,106,110,116],{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"assets\u002Ftemplate.md","ASSET","资产文件",998,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-host-based-intrusion-detection\u002Fassets\u002Ftemplate.md",{"path":92,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-host-based-intrusion-detection\u002FLICENSE",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fapi-reference.md","REFERENCE","参考文档",1571,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-host-based-intrusion-detection\u002Freferences\u002Fapi-reference.md",{"path":103,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fstandards.md",1520,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-host-based-intrusion-detection\u002Freferences\u002Fstandards.md",{"path":107,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fworkflows.md",1301,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-host-based-intrusion-detection\u002Freferences\u002Fworkflows.md",{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"scripts\u002Fagent.py","SCRIPT","脚本",5409,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-host-based-intrusion-detection\u002Fscripts\u002Fagent.py",{"path":117,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":118,"sourceHtmlUrl":119},"scripts\u002Fprocess.py",5677,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-host-based-intrusion-detection\u002Fscripts\u002Fprocess.py",[121,146,170,197,223,250],{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":128,"publishedAt":41},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[127],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[129,130,131,132,33,40,133,134,38,135,136,137,138,139,140,141,142,143,144,145],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":153,"publishedAt":41},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[152],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[154,142,155,156,33,157,40,38,158,159,160,161,162,163,164,165,166,167,168,169],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":180,"publishedAt":41},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[176,179],{"categoryNo":177,"categoryName":178,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[164,181,182,183,184,40,185,186,158,25,187,188,189,190,191,192,193,194,195,196],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":204,"publishedAt":41},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[203],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[205,206,207,40,208,209,210,211,212,213,214,215,216,217,218,219,161,220,221,222],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":224,"name":225,"nameZh":6,"description":226,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":227,"categories":228,"keywords":230,"publishedAt":41},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[229],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[231,232,233,40,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":251,"name":252,"nameZh":6,"description":253,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":254,"categories":255,"keywords":257,"publishedAt":41},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[256],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[33,258,40,259,35,260,261,262,263,264,265,192,266,193,267,268,269,270,271,272],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]