Lately I’ve been working a lot with OSSEC, which is an open source host-based intrusion detection system (HIDS). This has primarily involved installing Linux or Windows based agents onto servers and configuring them to point to the OSSEC server, a process which is straight forward and fairly well documented. Unfortunately you aren’t going to be able to run an agent on some devices, such as those provided by Cisco or Juniper, so we instead have to look towards agentless or syslog monitoring.