Skip to content
Get packs

Configuring Host-Based Intrusion Detection

Sets up Wazuh/OSSEC/AIDE host monitoring for file integrity, rootkit checks and alert triage.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

When installed, this skill gives the agent a step-by-step playbook for deploying host-based intrusion detection agents (Wazuh, OSSEC, AIDE) on Windows and Linux machines. The agent can write the configuration for file integrity monitoring, rootkit checks, custom alert rules, automated responses and forwarding of alerts to a SIEM. It also includes Python helpers that call the Wazuh API and summarise exported alert files.

Great for

  • Security or sysadmins rolling out Wazuh or OSSEC agents across a fleet of endpoints
  • Teams that need file integrity monitoring to meet PCI DSS 11.5 or NIST SI-7 requirements
  • Engineers who want a starting configuration to tune rather than writing ossec.conf from scratch

Skip it if

  • Network intrusion detection (Suricata, Snort) or EDR deployment, which the skill itself says are out of scope
  • Production changes applied without review: the sample configs include auto-blocking and account-disabling responses that can lock out legitimate users
  • Environments where you cannot verify the scripts, since they call APIs with credentials and can disable TLS verification

Try asking

  • “Write a Wazuh agent config that monitors /etc and C:\Windows\System32 for file changes in real time”
  • “Create custom Wazuh rules that alert when SSH config or system binaries are modified”
  • “Summarise this alerts.json export from Wazuh by agent and rule level”
  • “Explain how to forward Wazuh alerts to Splunk using Filebeat”
Step-by-step guide: how to use Configuring Host-Based Intrusion DetectionInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    configuring-host-based-intrusion-detection.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip configuring-host-based-intrusion-detection.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip configuring-host-based-intrusion-detection.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Test every configuration on a lab endpoint or staging group before rolling out, especially active-response rules that block IPs or disable accounts.
  • Only set SKIP_TLS_VERIFY=true in lab environments; leaving it on in production disables certificate checks for API calls.
  • Give the agent the operating system and Wazuh version you use, since package URLs and paths differ between versions and platforms.

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.