Network monitoring watches traffic crossing the wire. It does not see a process reading a file it should never open.
That gap is what a host-based intrusion detection system fills.
What Is a HIDS?
A HIDS monitors activity on an individual computer or server rather than the network.
Most install an agent on each host. Some environments use agentless log collection or syslog where an agent cannot be installed. This can provide useful visibility, but generally offers less host telemetry than an endpoint agent. Security Onion makes this same distinction between comprehensive agent telemetry and Syslog-based collection. (Security Onion Documentation)
Signature-based rules match known attack patterns. Anomaly-based detection looks for activity that differs from an established baseline and can identify suspicious behaviour that does not match a known signature, although it can also produce false positives. NIST describes both signature and anomaly-based detection approaches. (NIST Publications)
How Does It Work?
Many HIDS platforms include file integrity monitoring, while some also provide rootkit or malware-behaviour detection. Wazuh and OSSEC support both, but this is not universal across every HIDS. (Wazuh Documentation)
A host agent can observe local processes, file changes, registry activity, and other endpoint events that may not be visible in network traffic alone. NIST specifically lists processes, file access/modification, system logs, and configuration changes as host-based IDPS data sources. (NIST Publications)
HIDS vs NIDS
HIDS runs on individual hosts, watching logins, files, and processes.
NIDS monitors traffic at network chokepoints, detecting scanning, exploitation, and malicious traffic.
NIDS provides visibility into activity crossing monitored network points, while HIDS provides visibility into activity occurring on individual hosts. Together they provide complementary views of an attack.
How Does HIDS Differ From EDR?
Modern EDR typically adds deeper behavioural telemetry, investigation, threat hunting, and response capabilities such as host isolation. Traditional HIDS generally focuses more on host logs, file integrity, configuration changes, and detection. Cost varies by product and deployment.
HIDS-style monitoring can complement EDR on servers, legacy systems, and regulated environments. Where no agent can be installed, remote log collection or Syslog may provide partial host visibility.
Why Does It Matter?
PCI DSS includes specific file-integrity/change-detection and logging requirements. HIPAA requires audit controls and regular review of information-system activity, but it does not specifically mandate a HIDS or file-integrity-monitoring product. ISO 27001 similarly requires appropriate logging, monitoring, and integrity controls rather than a specific HIDS technology. (PCI Security Standards Council)
The security case is stronger. Insider misuse, credential abuse, and post-compromise activity often generate no unusual network traffic. What gives them away is behaviour on the host.
Common Mistakes
- Deploying it and never tuning it. An untuned HIDS can generate excessive noise, making genuine alerts harder for analysts to identify and investigate.
- Covering servers but not endpoints. Build systems, developer workstations, and jump hosts are frequent first stops.
- Treating detection as prevention. Traditional HIDS primarily detects and alerts. Some platforms also include active-response capabilities, while a HIPS is specifically designed to prevent or block activity. OSSEC, for example, includes active response despite being described as a HIDS. (OSSEC)
How to Reduce the Risk
- Baseline normal activity before alerting, then tune continuously
- Forward logs to storage the host cannot alter
- Cover critical hosts, including build servers and admin machines
- Define who triages each alert and who can act
Common HIDS Tools
OSSEC is a long-standing open-source HIDS covering log analysis, integrity checking, registry monitoring, rootkit detection, and active response. Wazuh originated from OSSEC and has grown into a broader security platform with agents, centralized analysis, its own indexer and dashboard, and optional integrations with platforms such as Elastic. (OSSEC)
Security Onion combines network visibility with host visibility. It uses tools such as Suricata/Zeek for network monitoring and Elastic Agent, Syslog, and osquery for endpoint and host telemetry. (Security Onion Documentation)
What Should Security Testing Cover?
Ask your testers to establish:
- Whether simulated attack activity generates alerts, and at what severity
- Whether anyone triages those alerts, and how long it takes
- Whether a local administrator can disable or blind the agent
How OraSec Can Help
OraSec tests detection outcomes rather than tooling claims. We run attack chains against monitored hosts and measure what your HIDS records and what reaches an analyst.
Conclusion
A HIDS is the layer that sees what happens inside a host after something gets in. Its value depends on tuning and follow-through. Detection that nobody reads is documentation, not defence.
FAQs
Do we still need HIDS if we have EDR? It depends. Modern EDR may already provide much of the host telemetry and behavioural detection a traditional HIDS offers, while dedicated FIM or host-log monitoring can still be useful on servers or for specific compliance and monitoring needs.
Does HIDS slow servers down? Agents consume CPU, memory, and disk. Impact is manageable when logging scope and rules are tuned to the host's role. Can HIDS help with compliance? Yes. HIDS capabilities such as logging and file-integrity monitoring can help satisfy parts of security frameworks, but compliance depends on the complete control environment rather than deploying a HIDS alone.
