EventSentry File Monitoring vs OSSEC

EventSentry File Monitoring tracks file additions and removals, size and SHA-256 checksum changes, and transaction-log tampering. It can gather digital certificates and entropy, which may help detect certain ransomware outbreaks. Changes can be logged to the Application event log with customizable severity and previous and new sizes or checksums. The current status of monitored files can be consolidated in the EventSentry database for comparisons across computers.

Notifications and integrations can go to email, MSSQL, PostgreSQL, MySQL or Oracle databases, HTTP(S), Syslog, SNMP traps, and executable processes. Exported text event logs can be cryptographically signed and timestamped to help identify tampering. EventSentry says its file integrity monitoring helps with PCI requirement 11.5. The full edition is an on-premise perpetual license listed at $85 per Windows device; EventSentry Light is free for five machines. A 30-day trial is listed. The feature is listed for Linux, macOS, web, and Windows, while the detailed supported operating-system list names Windows versions from NT 4 SP6 through Server 2025.

OSSEC is an open-source host-based intrusion detection system for monitoring systems and network components. It analyzes logs, checks file integrity, monitors the Windows registry, detects rootkits, and can alert users in real time or take active response actions. Monitoring can be agent-based or agentless, and a centralized server applies policies across operating systems, with server-specific overrides. Alerts can use SMTP, SMS, and syslog; active response can block an attack immediately. The system runs on Linux, OpenBSD, FreeBSD, macOS, Solaris, and Windows, and supports self-hosted and cloud environments. OSSEC and OSSEC+ use command-line management; Atomic OSSEC editions add a management console and integrations with cloud services and other tools. OSSEC+ adds machine learning, ELK integration, threat sharing, and additional rules. Free OSSEC is listed at free; OSSEC+ is also free, with registration required. Atomic OSSEC is $5 a month per device. Atomic OSSEC SaaS offers a free 14-day trial for up to 10 endpoints.