Open Source Tripwire vs OSSEC

Open Source Tripwire is free file and directory integrity-monitoring software for Linux, macOS, BSD variants, Solaris, AIX, HP-UX, Minix, Haiku, GNU/Hurd, and Cygwin. It compares the current filesystem with a known baseline and reports differences. A policy file defines monitored paths and checked attributes such as hashes, permissions, and ownership. Policy, configuration, and database files are signed by default, while reports may also be signed. Email reports are available when enabled in configuration. The project suggests scheduling periodic checks with cron, but its install script does not create those jobs. RPM, Debian, and make-based installation use a setup script for initial keys and policy creation. It runs on the user’s own system rather than as a managed service. Windows builds through Cygwin lack Registry monitoring and Windows-specific file attributes. The software uses GNU GPL version 2 or any later version. Separate commercial Tripwire products are also offered.

OSSEC is an open-source host-based intrusion detection system for monitoring systems and network components. It analyzes logs, checks file integrity, monitors the Windows registry, detects rootkits, and can alert users in real time or take active response actions. Monitoring can be agent-based or agentless, and a centralized server applies policies across operating systems, with server-specific overrides. Alerts can use SMTP, SMS, and syslog; active response can block an attack immediately. The system runs on Linux, OpenBSD, FreeBSD, macOS, Solaris, and Windows, and supports self-hosted and cloud environments. OSSEC and OSSEC+ use command-line management; Atomic OSSEC editions add a management console and integrations with cloud services and other tools. OSSEC+ adds machine learning, ELK integration, threat sharing, and additional rules. Free OSSEC is listed at free; OSSEC+ is also free, with registration required. Atomic OSSEC is $5 a month per device. Atomic OSSEC SaaS offers a free 14-day trial for up to 10 endpoints.