EventSentry File Monitoring vs Samhain
EventSentry File Monitoring
eventsentry.comSamhain
la-samhna.deSide by side
| Figure | EventSentry File Monitoring | Samhain |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | — | Yes |
| Plans published | 2 | 0 |
| Spec score · File Integrity Monitoring Software | 8.5 (#7) | 7.3 (#24) |
| Integrations | Notification and integration targets include email, MSSQL/PostgreSQL/MySQL/Oracle databases, HTTP(S), Syslog, SNMP traps and executable processes. | Samhain can function as a Prelude sensor, includes a Nagios plugin, and can send messages to named pipes, System V message queues, and external programs. |
| Purpose | File integrity monitoring tracks additions, removals, size changes, SHA-256 checksum changes and transaction-log tampering. | Samhain is a file integrity and host based intrusion detection system that monitors files and logs, and detects rootkits, rogue SUID executables, open ports, and hidden processes. |
| Security | Event logs exported to text files can be cryptographically signed and timestamped to detect tampering. | Samhain supports signed database and configuration files, signed reports, authenticated client connections, encrypted central logging, and stealth options. |
| Support | EventSentry Light includes community support, while the full edition includes phone and email support plus getting-started assistance. | Support options include documentation, a user forum and mailing list, bug reports by contact form or email, and an inquiry option for commercial installation or maintenance support. |
Plans
EventSentry File Monitoring
- EventSentry LightFree
- EventSentry$85, paid once
In their own words
EventSentry File Monitoring
EventSentry File Monitoring tracks file additions and removals, size and SHA-256 checksum changes, and transaction-log tampering. It can gather digital certificates and entropy, which may help detect certain ransomware outbreaks. Changes can be logged to the Application event log with customizable severity and previous and new sizes or checksums. The current status of monitored files can be consolidated in the EventSentry database for comparisons across computers.
Notifications and integrations can go to email, MSSQL, PostgreSQL, MySQL or Oracle databases, HTTP(S), Syslog, SNMP traps, and executable processes. Exported text event logs can be cryptographically signed and timestamped to help identify tampering. EventSentry says its file integrity monitoring helps with PCI requirement 11.5. The full edition is an on-premise perpetual license listed at $85 per Windows device; EventSentry Light is free for five machines. A 30-day trial is listed. The feature is listed for Linux, macOS, web, and Windows, while the detailed supported operating-system list names Windows versions from NT 4 SP6 through Server 2025.