OSSEC vs SELKS
OSSEC
ossec.net
SELKS
stamus-networks.comSide by side
| Figure | OSSEC | SELKS |
|---|---|---|
| Price from | $4.58/mo | Free |
| Free plan | Yes | Yes |
| Free trial | Yes | — |
| Open source | Yes | Yes |
| Web | — | Yes |
| Windows | Yes | Yes |
| macOS | Yes | — |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 5 | 1 |
| Spec score · Intrusion Detection and Prevention Software | 9.0 (#4) | 8.3 (#7) |
| Documentation depth | The manual includes architecture, supported systems, agents, log monitoring, syscheck, rootcheck, rules, decoders, output formats, configuration syntax, man pages and examples. | The project wiki includes user setup, Docker and ISO installation, developer build/customization material, tutorials, Splunk documentation and older-version guides. |
| Integrations | Atomic OSSEC lists Splunk, Sumo Logic, Jira, ArcSight, BMC Remedy, Elasticsearch, AWS CloudTrail, Slack, ServiceNow, VirusTotal, Cisco, Palo Alto and Cloudflare integrations. | The documented deployment can send logs to a Splunk indexer and optionally authenticate users through LDAP or LDAPS. |
| License | OSSEC is distributed under the GNU General Public License version 2. | SELKS is free and open source under the GPL 3.0-or-later license. |
| Rating on G2 | 4.6 out of 5 from 10 reviews | The surfaced G2 listing was for related Suricata Turnkey GUI, rated 4.0 out of 5 from 2 reviews; it was not a SELKS product profile. |
| Self-hosting | The free editions are downloadable source and binaries intended for local deployment, while Atomic OSSEC is offered on premises or as SaaS. | SELKS is designed for local deployment, including air-gapped ISO installations and Docker Compose on an existing Linux system. |
| What it does | OSSEC is a scalable, cross-platform open-source host-based intrusion detection system. | SELKS combines Suricata intrusion detection/prevention, network-security monitoring and threat hunting in a turnkey Debian-based distribution. |
Plans
In their own words
OSSEC
OSSEC is an open-source host-based intrusion detection system for monitoring systems and network components. It analyzes logs, checks file integrity, monitors the Windows registry, detects rootkits, and can alert users in real time or take active response actions. Monitoring can be agent-based or agentless, and a centralized server applies policies across operating systems, with server-specific overrides. Alerts can use SMTP, SMS, and syslog; active response can block an attack immediately. The system runs on Linux, OpenBSD, FreeBSD, macOS, Solaris, and Windows, and supports self-hosted and cloud environments. OSSEC and OSSEC+ use command-line management; Atomic OSSEC editions add a management console and integrations with cloud services and other tools. OSSEC+ adds machine learning, ELK integration, threat sharing, and additional rules. Free OSSEC is listed at free; OSSEC+ is also free, with registration required. Atomic OSSEC is $5 a month per device. Atomic OSSEC SaaS offers a free 14-day trial for up to 10 endpoints.
SELKS
SELKS is a free, open-source software package for network intrusion detection and prevention, network security monitoring, and threat hunting, built around Suricata. Its web interface manages Suricata rulesets, threat intelligence sources, custom rules, and IoC data files. Predefined filters and contextual views support threat hunting; thresholding and suppression can help reduce noisy alerts. SELKS 10 includes Suricata, Elasticsearch, Logstash, Kibana, Stamus Community Edition, and functionality from Arkime, Evebox, and CyberChef. It can capture packets tied to detection events and export session PCAP files for investigation or playback in SELKS or other tools. Deployment options include Docker Compose for Linux and Debian-based ISO images, with or without a desktop, on bare metal or a virtual machine. SELKS is licensed under GPL 3.0-or-later. Stamus Networks says it stopped actively enhancing the legacy product on January 1, 2025, and has no future releases planned. The maker says SELKS was not designed for enterprise deployment.