HIDS

TECHNICAL DEFINITION

A Host-based Intrusion Detection System (HIDS) is a software agent deployed on an individual host (e.g., server, workstation) to monitor system logs, file integrity, user activity, and running processes for anomalous or malicious behavior, providing real-time alerts to security administrators about potential cyber threats or policy breaches.

BACKGROUND

Computer security is a subdiscipline within the field of information security. It focuses on protecting computer software, systems, and networks from threats that can lead to unauthorized information disclosure, theft, or damage to hardware, software, or data, as well as to the disruption or misdirection of the services they provide.

SYNONYMS & ALIASES

• Host IDS
• Endpoint IDS
• Host Intrusion Detection System

USAGE NOTE

HIDS is primarily used for endpoint security, offering granular visibility into the internal state and activities of individual machines, often complementing network-based detection systems.

DEVELOPERS

Organizations developing technology related to HIDS.

• CrowdStrike

  CrowdStrike's Falcon platform provides endpoint protection, detection, and response (EDR) which encompasses advanced Host Intrusion Detection System (HIDS) capabilities, monitoring host activities for malicious behavior.

• SentinelOne

  SentinelOne's Singularity Platform offers AI-powered endpoint protection and EDR, including HIDS functionalities to detect and prevent threats at the host level by monitoring system processes, files, and network connections.

• Trend Micro

  Trend Micro develops various endpoint security solutions, such as Apex One, that integrate HIDS features to monitor for suspicious activities, unauthorized changes, and policy violations on individual hosts.

• Wazuh

  Wazuh is an open-source security platform that provides unified XDR and SIEM capabilities, with a strong focus on HIDS. It monitors endpoints for security threats, integrity checking, log data analysis, and regulatory compliance.

• Microsoft

  Microsoft Defender for Endpoint is a comprehensive endpoint security solution that includes extensive HIDS capabilities for Windows, macOS, Linux, Android, and iOS devices, providing threat detection, investigation, and response.

• Palo Alto Networks

  Palo Alto Networks' Cortex XDR platform integrates endpoint detection and response (EDR) with HIDS functions, offering threat prevention, detection, and response across networks, endpoints, and cloud environments.

• Sophos

  Sophos Intercept X provides advanced endpoint protection with HIDS-like features, using deep learning AI to detect and prevent known and unknown malware, exploits, and ransomware on host systems.

• Elastic

  Elastic Security, built on the Elastic Stack, includes endpoint security features that perform HIDS-like monitoring by collecting and analyzing host data for threat detection, hunting, and response.