Skip to content

Host-Based Intrusion Detection

What is Host-Based Intrusion Detection?

A security system installed on individual hosts that monitors system calls, file modifications, and logs to detect suspicious activity on that specific device.

Information Security

Frameworks that govern host-based intrusion detection

NIST SP 800-53 Rev 5View framework →CIS Controls v8View framework →

What the standards actually require on host-based intrusion detection

Requirements naming host-based intrusion detection across 6 standards, quoted from the control text.

CIS Controls v81 control

Where suitable and/or supported, deploy host-based intrusion detection on enterprise assets.

CIS-13.2 · Deploy a Host-Based Intrusion Detection Solution →
CIS Controls v8.11 control

Install host-based intrusion detection on enterprise assets where it is suitable or supported. Implementation Groups: IG2 and IG3 (not in the IG1 baseline; applies from IG2 upward). Asset type: Devices. Security function: Detect.

cis-controls-v8-1::13.2 · Deploy a Host-Based Intrusion Detection Solution →
ASD Strategies to Mitigate Cyber Security Incidents1 control

Host-based intrusion detection/prevention system to identify anomalous behaviour and known malicious activity.

ASD37-29 · Host-based IDS/IPS (Very Good) →
MDS2 (Medical Device)1 control

Discloses the device's ability to prevent, detect and remove malware: whether it can host executable software (MLDP-1); whether it supports anti-malware software or another mechanism, with any constraints on purchase, installation or configuration noted (MLDP-...

mds2-medical-device::MLDP · MLDP Malware detection and protection: disclose anti-malware support, its limits, compensating controls, allow-listing and host intrusion detection →
NIST SP 800-1461 control

Apply NIST SP 800-146 Chapter 7 IaaS operational recommendations to every IaaS service consumed. Coverage must include (a) infrastructure-as-code as the canonical provisioning method (no manual console provisioning of production), (b) base image and template h...

NISTSP146-4 · IaaS Operational Recommendations and Workload Hardening →
PCI P2PE1 control

CA application logs carry a digital signature or an ISO 16609 symmetric MAC so that alteration is detectable, with the signing or MAC key protected in an SCD under the key-management requirements of the standard.

pci-p2pe::25-7 · PCI P2PE 25-7 →

Questions people ask about host-based intrusion detection

What is Host-Based Intrusion Detection?
A security system installed on individual hosts that monitors system calls, file modifications, and logs to detect suspicious activity on that specific device.
Why is Host-Based Intrusion Detection important for compliance?
Host-Based Intrusion Detection is a key concept in Information Security. Understanding host-based intrusion detection helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Host-Based Intrusion Detection?
Host-Based Intrusion Detection appears in the requirement text of CIS Controls v8, CIS Controls v8.1, ASD Strategies to Mitigate Cyber Security Incidents, MDS2 (Medical Device), NIST SP 800-146. Across these standards we have identified 6 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Host-Based Intrusion Detection?
Explore our compliance framework pages to see how host-based intrusion detection applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Host-Based Intrusion Detection applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.