Skip to content
Get packs

Guide · Agent skill

How to use the Configuring Host-Based Intrusion Detection agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This guide explains what the configuring-host-based-intrusion-detection agent skill does, how to install it, and how to ask an agent for help deploying host-based intrusion detection (HIDS) agents such as Wazuh, OSSEC and AIDE. It is written for people who have not used agent skills before. By the end you will know how to add the skill, what requests will trigger it, and what to check before applying any generated configuration.

Configuring Host-Based Intrusion Detectionmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download the ZIP. Download the skill archive from this page.
  2. 2Unzip into a skills folder. Extract it into ~/.claude/skills/ for all projects, or into a project's .claude/skills/ folder for one project.
  3. 3Or upload in the Claude apps. In the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.
  4. 4Check prerequisites. Confirm your Wazuh manager is reachable on ports 1514 and 1515 and that you have admin access to endpoints.
  5. 5Ask for a specific outcome. Describe the endpoints, OS and compliance goal, for example FIM for PCI DSS 11.5 on Linux servers.
  6. 6Review the generated configuration. Check directories, ignore lists and active response actions against your environment before applying.
  7. 7Test on one endpoint. Apply the configuration to a non-production machine and confirm alerts appear before wider rollout.

What does the skill make the agent do?

The skill gives the agent a step-by-step playbook for deploying host-based intrusion detection agents on Windows and Linux endpoints. Its source covers installing the Wazuh agent, configuring file integrity monitoring (FIM) through the syscheck module, setting up rootkit checks through rootcheck, writing custom log analysis rules, defining active response actions, and forwarding Wazuh alerts to a SIEM.

The skill's stated scope excludes network-based IDS such as Suricata and Snort, and EDR deployment.

  • File integrity monitoring: watched directories, scan frequency, real-time checks and ignore lists
  • Rootkit detection: rootcheck settings and the signature files it references
  • Custom alert rules written in local_rules.xml
  • Active response: automated actions such as firewall-drop or disable-account
  • SIEM integration: forwarding alerts.json through Filebeat

How do you install the skill?

Download the skill ZIP from this page. Then choose one of two routes.

For Claude Code, unzip the archive into ~/.claude/skills/ to make it available for all your projects, or into a project's .claude/skills/ folder to limit it to that project.

In the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.

How do you trigger the skill with a natural request?

You do not need to name the skill. The skill's description says it activates for requests involving HIDS configuration, file integrity monitoring, OSSEC or Wazuh deployment, or host-based detection. Describe the outcome you want in plain language and mention the tool or compliance requirement if you have one.

Requests that should match include deploying Wazuh agents across endpoints, building an FIM policy, or meeting change detection requirements.

  • Help me deploy Wazuh agents to our Windows and Ubuntu workstations and point them at our manager.
  • Write a syscheck config that monitors /etc, /usr/bin and /usr/sbin in real time for our PCI DSS 11.5 scope.
  • Create a local rule that alerts when files change in /tmp and a rule that flags edits to sshd_config.
  • Show me how to set up active response to block an IP after repeated SSH failures, and explain the risks.

What does the skill need before you run anything?

The skill's source lists these prerequisites. A Wazuh server (manager) must be deployed and reachable from endpoints on ports 1514 and 1515. You need administrative access to the target endpoints. For the Python scripts you need Python 3 with the requests library, and for agent.py a Wazuh API username and password. osquery is optional and referenced by agent.py. A Wazuh dashboard is listed for alert visualisation.

  • Wazuh manager reachable on TCP/UDP 1514 and TCP 1515
  • Administrative access to each endpoint
  • Python 3 with requests (pip install requests, as listed in the reference file)
  • Wazuh API credentials for agent.py
  • Optional: osquery
pip install requests

What do the scripts do and what are the safety notes?

The skill includes two Python scripts. scripts/agent.py calls the Wazuh API and needs credentials. scripts/process.py summarises exported alert files. The skill makes network calls and runs scripts, so read them before running them in your environment.

The sample configurations include automated responses that can block IP addresses or disable accounts, which can lock out legitimate users. The source notes that the scripts call APIs with credentials and can disable TLS verification. Do not run them against production systems without review, and do not use them where you cannot verify what they do.

  • Review every active response block before deployment, especially disable-account.
  • Test FIM and rule changes on a non-production endpoint first.
  • Check any TLS verification setting in agent.py before use.
  • Keep Wazuh API credentials out of shared chat logs and version control.

Example: a first deployment workflow

A typical session starts with a request for a deployment plan. The agent can produce the Windows or Linux agent install steps, a syscheck block, a rootcheck block and custom rules. You then review each block against your asset list and compliance scope, apply it on a test endpoint, and confirm alerts reach the manager before rolling out to the fleet.

The skill also includes a deployment template with tables for FIM directories, monitoring modules and custom rules, which can help document the rollout.

What people use it for

  • Rolling out Wazuh agents across a mixed Windows and Linux fleet
  • Drafting a file integrity monitoring policy for PCI DSS 11.5 or NIST SI-7 scope
  • Writing custom Wazuh rules for changes to system binaries or SSH configuration
  • Summarising exported Wazuh alert files with the included process.py script
  • Starting from a sample ossec.conf configuration and tuning it for noisy paths

Frequently asked questions

How do I install the configuring host-based intrusion detection skill?

Download the skill ZIP from this page and unzip it into ~/.claude/skills/ for all projects, or into a project's .claude/skills/ folder. In the Claude apps, you can instead upload it under Settings, then Capabilities, then Skills.

Is this skill free to use?

The skill is licensed under Apache-2.0, as stated on this page. Check the repository licence file for the full terms. Wazuh, OSSEC and AIDE are separate tools with their own licences, and the skill does not provide them.

What do I need to run it?

You need a reachable Wazuh manager on ports 1514 and 1515, administrative access to endpoints, and Python 3 with requests for the scripts. agent.py also needs a Wazuh API username and password, and osquery is optional.

Can it deploy EDR or network intrusion detection?

No. The skill states that network IDS such as Suricata and Snort, and EDR deployment, are out of scope. Use a dedicated tool for those.

What are good alternatives to this skill?

The skill's source names AIDE as a standalone file integrity checker for Linux, Tripwire as a commercial FIM product and Samhain as an open-source HIDS focused on file integrity and logs. Compare them on platform support and licensing before choosing.

Why did the agent's configuration trigger lockouts?

Sample active response rules can auto-block IPs or disable accounts after failures. Review rules_id, timeout and command values, and test on a non-production endpoint before enabling them.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits security engineers and sysadmins who are rolling out Wazuh or OSSEC agents and want a starting configuration for file integrity monitoring, rootkit checks and alert rules to tune. It is not the right choice for network IDS, EDR, or teams that cannot review scripts and automated responses before running them.

Download the skill