Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Configuring Host-Based Intrusion Detection · mukul975 | DecimalAI

Configuring Host Based Intrusion Detection

SkillScore41Maintained

configuring-host-based-intrusion-detection

Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations. Use when deploying OSSEC, Wazuh, or AIDE for endpoint monitoring, building file integrity monitoring (FIM) policies, or meeting compliance requirements for change detection. Activates for requests involving HIDS configuration, file integrity monitoring, OSSEC/Wazuh deployment, or host-based detection.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/configuring-host-based-intrusion-detection/SKILL.md

decimalai skills pull configuring-host-based-intrusion-detection --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/configuring-host-based-intrusion-detection/SKILL.md https://app.decimal.ai/s/configuring-host-based-intrusion-detection/SKILL.md

Raw file: /s/configuring-host-based-intrusion-detection/SKILL.md ↗ · machine-readable summary at /s/configuring-host-based-intrusion-detection.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +32% lift · at higher cost+83% tokens0% turns41% of whole cases pass with skill (9/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	—	—
case-11	✗→✓	▲ Improved	—	—
case-06	✗→✓	▲ Improved	—	—
case-10	✗→✓	▲ Improved	—	—
case-02	✗→✓	▲ Improved	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/configuring-host-based-intrusion-detection/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/1/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Configuring Host-Based Intrusion Detection

When to Use

Use this skill when:

Deploying HIDS agents (Wazuh, OSSEC, AIDE) across Windows and Linux endpoints
Configuring file integrity monitoring (FIM) for compliance (PCI DSS 11.5, NIST SI-7)
Monitoring system configuration changes, rootkit detection, and security policy violations
Integrating HIDS alerts with SIEM platforms for centralized monitoring

Do not use this skill for network-based IDS (Suricata, Snort) or for EDR deployment.

Prerequisites

Wazuh server (manager) deployed and accessible from endpoints
Administrative access to target endpoints
Network connectivity: agents to Wazuh manager on port 1514 (TCP/UDP) and 1515 (TCP enrollment)
Wazuh dashboard (OpenSearch Dashboards) for alert visualization
Understanding of critical files/directories to monitor per OS

Workflow

Step 1: Install Wazuh Agent

Windows:

powershell
# Download and install Wazuh agent
Invoke-WebRequest -Uri "https://packages.wazuh.com/4.x/windows/wazuh-agent-4.9.0-1.msi" `
  -OutFile "wazuh-agent.msi"
msiexec /i wazuh-agent.msi /q WAZUH_MANAGER="wazuh-manager.corp.com" `
  WAZUH_REGISTRATION_SERVER="wazuh-manager.corp.com" WAZUH_AGENT_GROUP="windows-workstations"
net start WazuhSvc

Linux (Debian/Ubuntu):

bash
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --dearmor -o /usr/share/keyrings/wazuh.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" \
  > /etc/apt/sources.list.d/wazuh.list
apt-get update && apt-get install wazuh-agent -y
sed -i 's/MANAGER_IP/wazuh-manager.corp.com/' /var/ossec/etc/ossec.conf
systemctl daemon-reload && systemctl enable --now wazuh-agent

Step 2: Configure File Integrity Monitoring (FIM)

Edit agent configuration (/var/ossec/etc/ossec.conf or C:\Program Files (x86)\ossec-agent\ossec.conf):

xml
<syscheck>
  <!-- Scan frequency: every 12 hours -->
  <frequency>43200</frequency>
  <scan_on_start>yes</scan_on_start>
  <alert_new_files>yes</alert_new_files>

  <!-- Linux critical directories -->
  <directories check_all="yes" realtime="yes">/etc</directories>
  <directories check_all="yes" realtime="yes">/usr/bin</directories>
  <directories check_all="yes" realtime="yes">/usr/sbin</directories>
  <directories check_all="yes" realtime="yes">/bin</directories>
  <directories check_all="yes" realtime="yes">/sbin</directories>
  <directories check_all="yes">/boot</directories>

  <!-- Windows critical directories -->
  <directories check_all="yes" realtime="yes">C:\Windows\System32</directories>
  <directories check_all="yes" realtime="yes">C:\Windows\SysWOW64</directories>
  <directories check_all="yes" realtime="yes">%PROGRAMFILES%</directories>

  <!-- Windows registry monitoring -->
  <windows_registry>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run</windows_registry>
  <windows_registry>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce</windows_registry>
  <windows_registry>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services</windows_registry>

  <!-- Ignore frequently changing files -->
  <ignore>/etc/mtab</ignore>
  <ignore>/etc/resolv.conf</ignore>
  <ignore type="sregex">.log$</ignore>
</syscheck>

Step 3: Configure Rootkit Detection

xml
<rootcheck>
  <disabled>no</disabled>
  <frequency>43200</frequency>
  <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
  <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
  <system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>
  <check_dev>yes</check_dev>
  <check_files>yes</check_files>
  <check_if>yes</check_if>
  <check_pids>yes</check_pids>
  <check_ports>yes</check_ports>
  <check_sys>yes</check_sys>
  <check_trojans>yes</check_trojans>
  <check_unixaudit>yes</check_unixaudit>
</rootcheck>

Step 4: Configure Log Analysis Rules

xml
<!-- Custom rules in /var/ossec/etc/rules/local_rules.xml -->
<group name="local,syscheck,">
  <!-- Alert on critical binary modifications -->
  <rule id="100001" level="12">
    <if_sid>550</if_sid>
    <match>/usr/bin/|/usr/sbin/|/bin/|/sbin/</match>
    <description>Critical system binary modified: $(file)</description>
    <group>syscheck,pci_dss_11.5,</group>
  </rule>

  <!-- Alert on new executable in temp directories -->
  <rule id="100002" level="10">
    <if_sid>554</if_sid>
    <match>/tmp/|/var/tmp/</match>
    <description>New file created in temp directory: $(file)</description>
    <group>syscheck,malware,</group>
  </rule>

  <!-- Alert on SSH configuration changes -->
  <rule id="100003" level="10">
    <if_sid>550</if_sid>
    <match>/etc/ssh/sshd_config</match>
    <description>SSH configuration modified</description>
    <group>syscheck,authentication,</group>
  </rule>
</group>

Step 5: Configure Active Response

xml
<!-- Auto-block IP after repeated authentication failures -->
<active-response>
  <command>firewall-drop</command>
  <location>local</location>
  <rules_id>5712</rules_id>
  <timeout>600</timeout>
</active-response>

<!-- Disable account after brute force detection -->
<active-response>
  <disabled>no</disabled>
  <command>disable-account</command>
  <location>local</location>
  <rules_id>100100</rules_id>
  <timeout>3600</timeout>
</active-response>

Step 6: Integrate with SIEM

# Wazuh to Splunk via Filebeat
# Edit /etc/filebeat/filebeat.yml:
filebeat.inputs:
  - type: log
    paths:
      - /var/ossec/logs/alerts/alerts.json
    json.keys_under_root: true
output.elasticsearch:
  hosts: ["https://splunk-hec:8088"]

# Wazuh to Elastic via direct integration
# Wazuh indexer feeds directly into OpenSearch/Elasticsearch
# Dashboard: https://wazuh-dashboard:5601

Key Concepts

| Term | Definition | |------|-----------| | HIDS | Host-based Intrusion Detection System; monitors individual endpoints for malicious activity | | FIM | File Integrity Monitoring; detects unauthorized changes to files by comparing cryptographic hashes | | Syscheck | Wazuh/OSSEC module for file integrity monitoring and registry monitoring | | Rootcheck | Wazuh/OSSEC module for rootkit and malware detection | | Active Response | Automated defensive action triggered by HIDS alert (IP block, account disable) | | CDB List | Constant Database list used for custom lookups in Wazuh rules |

Tools & Systems

Wazuh: Open-source HIDS platform (fork of OSSEC) with manager, agent, and dashboard
OSSEC: Original open-source HIDS (predecessor to Wazuh)
AIDE (Advanced Intrusion Detection Environment): Standalone file integrity checker for Linux
Tripwire: Commercial file integrity monitoring solution
Samhain: Open-source HIDS focused on file integrity and log monitoring

Common Pitfalls

Monitoring too many directories: FIM on entire filesystems generates excessive alerts. Focus on critical system binaries, configuration files, and web roots.
Not excluding noisy files: Frequently changing files (logs, temp, caches) generate false positive FIM alerts. Maintain exclusion lists.
Ignoring baseline establishment: First FIM scan creates a baseline. Changes detected before baseline stabilization are noise, not threats. Allow 48 hours for baseline.
Active response without testing: Auto-blocking IPs or disabling accounts can cause outages. Test active response rules in a non-production environment first.
Agent enrollment failures: Agents must successfully enroll with the manager before monitoring begins. Verify firewall rules allow port 1514 and 1515 traffic.

Illustrative Want to see what configuring-host-based-intrusion-detection would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 01:03 UTC · 22 cases

Lift

+32%

41% vs 9%

Agent turns

1.0 vs 1.0

Tokens

+83%

3,456.27 vs 1,893.14

fail → pass · 7pass → pass · 2fail → fail · 13

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 We need to deploy host intrusion detection on our Ubuntu server fleet. Please provide a guide with the exact terminal commands to install the Wazuh agent, an example ossec.conf block to enable File Integrity Monitoring on key binary paths while excluding log files, and a sample local rules XML snippet to raise high-severity alerts when monitored binaries are modified.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-16 We want host file integrity checks to perform a scan every 12 hours (43200 seconds) and also run an initial scan immediately when the agent service starts. What syscheck XML settings control this behavior?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 Which default Windows system directories should be configured with realtime file integrity monitoring under the syscheck XML block?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 In Wazuh custom rules, we want to create rule 100001 with level 12 to trigger whenever a monitored file is modified by syscheck. Which parent rule ID must this custom rule inherit from?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 We need to set up network intrusion detection rules on our core perimeter firewall using Suricata. Can you provide a Suricata rule to detect incoming SQL injection attempts in HTTP GET request parameters?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 We need an active response block in ossec.conf to temporarily drop attacking IP addresses at the local firewall for 10 minutes when authentication failures trigger rule 5712. What XML parameters set the command and duration?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 We are configuring the host rootkit detection module in ossec.conf for Linux endpoints. What boolean XML settings ensure that system files, processes, network interfaces, and ports are all actively checked?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 In our host-based FIM configuration, routine application log updates are triggering excessive alert noise. We want to exclude any file ending with .log using regex pattern matching. What syscheck XML element should be added?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 Our network team needs to configure Snort 3 on an inline network tap to detect TCP SYN flooding on our external interface. What network rule syntax should be used?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 By default, file integrity monitoring alerts on modified files. What specific syscheck configuration setting must be set to 'yes' so that alerts are also generated whenever a completely new file is added to a monitored directory?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 We want to write a custom XML rule with ID 100003 at level 10 to alert administrators whenever the OpenSSH daemon configuration file /etc/ssh/sshd_config is modified. How should this rule be defined in local_rules.xml?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-06 When configuring host file integrity monitoring for Linux servers, we need to monitor system binary and configuration directories in real-time, but perform periodic non-realtime checks on the boot directory to save resources. How should the syscheck directory XML tags be written in the configuration file?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-10 We need a custom Wazuh rule (ID 100002, severity level 10) that alerts specifically when new files are created in temporary system directories like /tmp or /var/tmp. What parent rule SID and matching pattern should be configured in local_rules.xml?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-15 Our network security team needs the exact firewall port requirements for endpoint HIDS agents to communicate with and enroll into the central manager. Which network ports and transport protocols must be opened?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 When defining custom rules for file integrity monitoring of critical system binaries to satisfy compliance audit requirements (specifically PCI DSS requirement 11.5), what group tag should be added to the XML rule definition?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 We are deploying Filebeat on the Wazuh manager to forward HIDS alert logs directly to an external SIEM. What path should Filebeat collect alert logs from, and how should it process the alert structure?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-02 I'm setting up Wazuh monitoring across our Windows endpoints and need to configure automated defenses. Can you give me the PowerShell commands to silently install the agent with a centralized manager server, the syscheck XML configuration for watching Windows startup registry keys, and an active response configuration to block attacking IP addresses upon trigger?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-18 We are configuring HIDS syscheck monitoring on Windows server endpoints to watch registry keys used for persistence and service modifications. Which specific registry keys under HKEY_LOCAL_MACHINE should be specified in the configuration?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 After initial deployment of host file integrity monitoring, how long should security operations wait for baseline stabilization before considering FIM change alerts to be actionable security threats rather than initial noise?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We are deploying SentinelOne EDR agents across our corporate endpoints for process behavioral analysis and automated memory protection. Please explain the EDR endpoint policy settings for script control and anti-tamper protection.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 To mitigate brute force attacks on Linux servers, we want an automated active response command that disables the compromised user account for one hour when triggered by rule ID 100100. What XML snippet should be added to the agent configuration?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-22 When configuring an active response rule to automatically disable user accounts upon brute force login detection, what rule ID is specified in the active-response XML block to trigger account suspension?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +32 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 9.1%
Pass rate with the skill: 40.9%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 01:03 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run41

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+80% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.