Request a Demo

What’s the Difference Between OSSEC, OSSEC+ and Atomic OSSEC - Atomicorp - Unified Security Built on OSSEC

What’s the Difference Between OSSEC, OSSEC+ and Atomic OSSEC

Posted on by Dean Lombardo

By Scott Shinn

What’s the difference between OSSEC, OSSEC+, and Atomic OSSEC? We get asked that a lot. The quick answer is thousands of additional open source security rules, frequent updates and software integrations for real-time endpoint and cloud workload detection, built-in active response beyond HIDS, a graphical user interface (GUI), compliance capabilities, and expert professional support. (Watch the video below).

At a granular level, each platform has its benefits, and the three might represent a progression.

OSSEC is a free, open-source, host-based intrusion detection system (HIDS). The free set gives you 100s of open source security rules and a CLI-only intrusion detection system (IDS).

OSSEC+ is a more robust set of open source rules. OSSEC+ adds hundreds of additional rules to basic OSSEC, threat intelligence integration, add-ons, and a Read-Only UI.

Atomic OSSEC is an inexpensive commercial bundle of not only OSSEC/OSSEC+, but also thousands of additional open source rules and tools, including a DevSecOps management platform for OSSEC, ModSec, ClamAV, and many other tools. It brings a versatile highly compliant enterprise-grade security solution and real-time FIM for zero trust environments, active response, and countermeasures.

What’s the Difference Between OSSEC and Atomic OSSEC?

Why move from OSSEC or OSSEC+ to Atomic OSSEC?

Atomic OSSEC brings thousands of additional advanced OSSEC rules, plus ModSecurity web application firewall rules, in a single extended detection and response (XDR) system. It is the next progression for open source security, bringing with it advanced abilities to detect and block malware from the software supply chain.

Atomic OSSEC adds:

  • A Global Threat Intelligence Feed. We run an infrastructure where we are ingesting data from shared communities across the planet. The threat data goes into our system that is looking across IP addresses and files, and other technical indicators. It also captures threat intelligence from the CISA list, IPs and hashes, things we are tracking. We share it back to the OSSEC server.
  • A Rules and Decoder Updater. Based on crowdsourced and machine-driven developments in open source communities, this feature gives you deeper visibility into code and malware detection, active response, and an ability to thwart out in front. 
  • Intel on sources and engines attacking. Be able to more rapidly and effectively block spammers and also categorize threats. Identify spam source, known attackers, proxies, or IPs reported thousands of times, and what types of attacks they are employing. Other sources might be hashes in code, so we can detect and deflect that too.
  • The use of rules channels secured by inline and IPS file system protection via ModSecurity. Be able to protect your web applications and WordPress environments.
  • Open Source AV with ClamAV.
  • Command line visibility scans.
  • Defense against AI malware such as that impacting ChatGPT and other machine-generated malware. 
  • Easy plug-in to support legacy OSs and firewalls. The ability to install Atomic OSSEC on free Linux CentOS, as well as legacy systems such as AIX, HP-UX, Windows End of Life, and many others.
  • A graphical user interface (GUI) for reporting and analysis.
  • Professional support for FAQs, OSSEC projects and installations, rule updates, optimal configurations. 

Atomicorp Extended Detection and Response

Atomic OSSEC goes beyond HIDS with active response, building in additional security and risk controls and compliance tools. The Atomic OSSEC XDR system provides:

    • Advanced real-time FIM. Find out what in your computing environment changed. Get automatic log management that discovers discrepancies and mitigates false alarms.
    • Vulnerability scanning that allows you to get ahead of commercial software patches. 
    • Threat intelligence. Use global community threat data from OSSEC, ModSecurity and Atomicorp to automate, accelerate and extend protection and response.
    • Multifactor authentication and security key integration.
    • 5x the number of OSSEC+ rules. Several thousand additional security and real-time FIM rules to deploy.
    • Reporting and compliance including OpenSCAP, Center for Internet Security (CIS), PCI-DSS, HIPAA, GDPR, and more.
    • Integrated support of major cloud platforms AWS, Azure, GCP and single sign-on (SSO) integration.
    • SIEM integration: Out-of-the-box integration with Splunk, ArcSight, ELK, QRadar, and others.
    • Versatile management and analyst interface. Atomic OSSEC comes with a GUI powered by the powerful FIM and intrusion detection engine. Using the GUI, you can generate reports, and search, correlate, visualize, and further analyze events and series.
    • Dedicated professional support you wouldn’t otherwise get for the OSSEC rules.

Atomic OSSEC also empowers you to run block lists that include: 

  • DoS bots.
  • Spammers.
  • Brute force attackers.
  • Known attackers.
  • Multi-attackers.
  • Multi-firewall probes and web service gateways. 
  • Slow login failures.
  • Spyware.
  • Command and control servers.
  • Open proxies.
  • Fake search engines.
  • Level 2 spammers.
  • Linear brute force attackers. Is it a bot compromising an endpoint? Be able to detect and disable lateral attacks. Detect both input and output and be able to put a stop to it.

Watch my video exploring the differences between OSSEC, OSSEC+, and Atomic OSSEC. 

 

 

Learn more about the Atomic OSSEC vs. OSSEC+ advantage below. 

OSSEC vs OSSEC+ vs Atomic OSSEC

Get an Atomic OSSEC demonstration.

 

Visit our Slack channel to stay up to date on conferences, training sessions, and for content and Q&A. Join us on Slack.

Learn more about Atomic OSSEC for enterprise-grade endpoint and cloud workload protection. Vist the Atomic OSSEC page, which provides a comparative table between OSSEC, OSSEC+ and Atomic OSSEC.

Find out more about using Ghidra in an OSSEC environment. Read the article.