Samhain

Samhain is an open-source host-based intrusion detection system focused on monitoring the integrity and security state of Unix and Linux systems. Its capabilities include file integrity checking, log monitoring, detection of suspicious changes and checks associated with rootkits and other host-level anomalies. The software is designed for administrators who want an independent way to detect unexpected modifications on important systems rather than relying solely on network or endpoint telemetry from a commercial platform. Samhain can be useful in environments where configuration and file changes need to be tracked carefully, including servers and research systems. Its open-source nature also makes it relevant to security practitioners who want visibility into how host monitoring is implemented.