Auditing Local File System Events

For years we’ve been heavily leveraging Tripwire to perform localized HBIDS: http://www.tripwiresecurity.com/ But more recently we’ve been experimenting with the Open Source and versatile Samhain: http://www.la-samhna.de/samhain