What are some common tools for intrusion detection?

Question

Please give a brief description for each tool.

Answer 1

Snort

From their about page:

Originally released in 1998 by Sourcefire founder and CTO Martin Roesch, Snort is a free, open source network intrusion detection and prevention system capable of performing real-time traffic analysis and packet logging on IP networks. Initially called a “lightweight” intrusion detection technology, Snort has evolved into a mature, feature-rich IPS technology that has become the de facto standard in intrusion detection and prevention. With nearly 4 million downloads and approximately 300,000 registered users Snort, it is the most widely deployed intrusion prevention technology in the world.

Answer 2

Why don’t you check http://sectools.org/

Answer 3

Tripwire

Is an open source (though there's a closed source version) integrity checker that uses hashes to detect file modifications left behind by intruders.

Answer 4

OpenBSD has mtree(8): http://www.openbsd.org/cgi-bin/man.cgi?query=mtree It checks whether any files have changed in a given directory hierarchy.

Answer 5

Logcheck is a simple utility which is designed to allow a system administrator to view the logfiles which are produced upon hosts under their control.

It does this by mailing summaries of the logfiles to them, after first filtering out "normal" entries. Normal entries are entries which match one of the many included regular expression files contain in the database.

You should watch your logs as one part of a healthy security routine. It'll also help trap a lot of other (hardware, auth, load...) anomalies.

Answer 6

DenyHosts for SSH server.

Answer 7

For NIDS, Suricata and Bro are two free alternatives to snort.

Here's an interesting article discussing all three of them:
http://blog.securitymonks.com/2010/08/26/three-little-idsips-engines-build-their-open-source-solutions/

Have to mention OSSEC, which is a HIDS.