{"id":8645,"date":"2020-01-28T18:14:36","date_gmt":"2020-01-28T12:44:36","guid":{"rendered":"http:\/\/kalilinuxtutorials.com\/?p=8645"},"modified":"2020-01-28T18:14:36","modified_gmt":"2020-01-28T12:44:36","slug":"agentsmith-hids","status":"publish","type":"post","link":"https:\/\/kalilinuxtutorials.com\/agentsmith-hids\/","title":{"rendered":"AgentSmith-HIDS : Open Source Host-based Intrusion Detection System"},"content":{"rendered":"\n
Technically, AgentSmith-HIDS is not a Host-based Intrusion Detection System (HIDS) due to lack of rule engine and detection function. However, it can be used as a high performance ‘Host Information Collect Agent’ as part of your own HIDS solution. <\/p>\n\n\n\n
The comprehensiveness of information which can be collected by this agent was one of the most important metrics during developing this project, hence it was built to function in the kernel stack and achieve huge advantage comparing to those function in user stack, such as:<\/p>\n\n\n\n
Better performance<\/strong>, Information needed are collected in kernel stack to avoid additional supplement actions such as traversal of ‘\/proc’; and to enhance the performance of data transportation, data collected is transferred via shared ram instead of netlink.<\/li>
Hard to be bypassed<\/strong>, Information collection was powered by specifically designed kernel drive, makes it almost impossible to bypass the detection for malicious software like rootkit, which can deliberately hide themselves.<\/li>
Easy to be integrated<\/strong>\uff0cThe AgentSmith-HIDS was built to integrate with other applications and can be used not only as security tool but also a good monitoring tool, or even a good detector of your assets. The agent is capable of collecting the users, files, processes and internet connections for you, so let’s imagine when you integrate it with CMDB, you could get a comprehensive map consists of your network, host, container and business (even dependencies). What if you also have a Database audit tool at hand? The map can be extended to contain the relationship between your DB, DB User, tables, fields, applications, network, host and containers etc. Thinking of the possibility of integration with network intrusion detection system and\/or threat intelligence etc., higher traceability could also be achieved. It just never gets old.<\/li>
Kernel stack + User stack<\/strong>\uff0cAgentSmith-HIDS also provide user stack module, to further extend the functionality when working with kernel stack module.<\/li><\/ul>\n\n\n\n