Home / ossec / ossec-hids
AI Slop Code Risk Monitor

ossec/ossec-hids

SlopCodeMonitor badge for ossec/ossec-hids Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.

3.3 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for ossec/ossec-hids, a C project with 5,070 GitHub stars. SynthScan examined 254,298 lines of code across 1177 source files, recording 668 pattern matches distributed across 9 syntactic categories. The legacy adjusted pattern signal is 3.3 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

3.3
Adjusted Signal
3.3
Raw Pattern Score
100%
Time Factor
2026-10-31
Last Push
5.1K
Stars
C
Language
254.3K
Lines of Code
1.2K
Files
668
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 11.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 610 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 2 finding(s).

Agent Over-Engineering Ratio 4.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 56 finding(s).

PR Review Velocity Impact 14.6/100 · LOW

Which changes need focused human review? 668 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 3MEDIUM 60LOW 605

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 668 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block593 hits · 571 pts
SeverityFileLineSnippetContext
LOWinstall.sh1#!/bin/shCOMMENT
LOWinstall.sh801 # elseCOMMENT
LOWcontrib/active-list.pl1#!/usr/bin/perlCOMMENT
LOWcontrib/ossec2mysql.pl1#!/usr/bin/perl -wCOMMENT
LOWcontrib/ossec2mysql.pl21#COMMENT
LOWcontrib/ossec2mysql.pl41# database=ossecbaseCOMMENT
LOWcontrib/ossec2mysql.pl61# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See theCOMMENT
LOWcontrib/ossec-batch-manager.pl1#!/usr/bin/perlCOMMENT
LOWcontrib/ossec-batch-manager.pl21# the 'agent ID' wanting to be removed. Changed theCOMMENT
LOWcontrib/ossec-batch-manager.pl41# - changed the extract operation to store optionsCOMMENT
LOWcontrib/ossec2mysqld.pl1#!/usr/bin/perl -wCOMMENT
LOWcontrib/ossec2mysqld.pl21# as a simple script (ossec2mysql.pl).COMMENT
LOWcontrib/ossec2mysqld.pl41# dbhost=localhostCOMMENT
LOWcontrib/ossec2mysqld.pl61# but WITHOUT ANY WARRANTY; without even the implied warranty ofCOMMENT
LOWcontrib/ossectop.pl1#!/usr/bin/perl -wCOMMENT
LOWcontrib/ossectop.pl21# but WITHOUT ANY WARRANTY; without even the implied warranty ofCOMMENT
LOWcontrib/debian-packages/generate_ossec.sh1#!/bin/bashCOMMENT
LOWactive-response/firewall-drop.sh1#!/bin/shCOMMENT
LOWactive-response/nftables-drop.sh1#!/bin/shCOMMENT
LOWactive-response/cloudflare-ban.sh1#!/bin/shCOMMENT
LOWsrc/init/darwin-addusers.pl1#!/usr/bin/env perlCOMMENT
LOWsrc/os_maild/sendmail.c21#define VALIDBANNER "220"COMMENT
LOWsrc/os_maild/sendcustomemail.c21/* Default values used to connect */COMMENT
LOWsrc/os_maild/maild.h21#define DEFAULT_TIMEOUT 18 /* socket read timeout - 18 (*5)*/COMMENT
LOWsrc/os_maild/curlmail.c21#include <curl/curl.h>COMMENT
LOWsrc/os_maild/tests/maild_shutdown_gate_test.c1/* Copyright (C) 2026 Atomicorp, Inc.COMMENT
LOWsrc/os_crypto/sha256/sha256.c1#include <stdlib.h>COMMENT
LOWsrc/os_crypto/sha1/md32_common.h141#endifCOMMENT
LOWsrc/os_crypto/sha1/md32_common.h161#endifCOMMENT
LOWsrc/os_crypto/sha1/md32_common.h181/*COMMENT
LOWsrc/os_crypto/sha1/md32_common.h261/*COMMENT
LOWsrc/os_crypto/sha1/md32_common.h341#ifndef HOST_l2cCOMMENT
LOWsrc/os_crypto/sha1/sha_locl.h61COMMENT
LOWsrc/os_crypto/sha1/sha_locl.h101COMMENT
LOWsrc/os_crypto/sha1/sha_locl.h121# ifdef SHA1_ASMCOMMENT
LOWsrc/addagent/manage_agents.h81#define ADD_CONFIRM "Confirm adding it?(y/n): "COMMENT
LOWsrc/addagent/manage_agents.h141/* WIN32 errors */COMMENT
LOWsrc/os_xml/os_xml_internal.h21#define XML_VARIABLE_MAXSIZE 256COMMENT
LOWsrc/config/syscheck-config.h21#define CHECK_OWNER 0000010COMMENT
LOWsrc/config/csyslogd-config.h41COMMENT
LOWsrc/analysisd/analysisd.c21#include "os_execd/execd.h"COMMENT
LOWsrc/analysisd/analysisd.c41COMMENT
LOWsrc/analysisd/analysisd_stages.c21#include "eventinfo.h"COMMENT
LOWsrc/analysisd/pipeline.c21 * does have the __atomic_* builtins used below.COMMENT
LOWsrc/analysisd/testrule.c21#include "active-response.h"COMMENT
LOWsrc/analysisd/eventinfo.h141} EventList;COMMENT
LOWsrc/analysisd/rules.h21#include "lists.h"COMMENT
LOWsrc/analysisd/rules.h41#define DO_MAILALERT 0x002COMMENT
LOWsrc/analysisd/rules.h261COMMENT
LOWsrc/syscheckd/create_db.c1/* Copyright (C) 2009 Trend Micro Inc.COMMENT
LOWsrc/tests/regressions/issue_prev_matched_race.c21 * Run:COMMENT
LOWsrc/tests/regressions/README.md1# Analysisd / pipeline regression testsCOMMENT
LOWsrc/tests/regressions/README.md21# - issue_1079_last_events_uaf frequency last_events ownershipCOMMENT
LOWsrc/tests/regressions/README.md41# - issue_win_execd_cmd_injection WinExecd AR args safe for cmd.exeCOMMENT
LOWsrc/tests/regressions/README.md61# Also invoked from `make regression` (own Makefiles):COMMENT
LOWsrc/tests/regressions/README.md81# raw_input_queue_*, fts_queue_*, and *_delta fields in ossec-analysisd.state.COMMENT
LOWsrc/os_net/os_net.h21#ifndef AI_V4MAPPEDCOMMENT
LOWsrc/shared/file_op.c21#include <aclapi.h>COMMENT
LOWsrc/shared/file_op.c41#ifndef PRODUCT_BUSINESS_NCOMMENT
LOWsrc/shared/file_op.c61COMMENT
533 more matches not shown…
Decorative Section Separators52 hits · 210 pts
SeverityFileLineSnippetContext
MEDIUMcontrib/active-list.pl19# -----------------------COMMENT
MEDIUMcontrib/active-list.pl21# -----------------------COMMENT
MEDIUM⚡contrib/ossec2mysql.pl6# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysql.pl10# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysql.pl12# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysql.pl14# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysql.pl16# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysql.pl22# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysql.pl24# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysql.pl30# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysql.pl32# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysql.pl68# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysql.pl70# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysql.pl77# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysql.pl79# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysql.pl81# ---------------------------------------------------------------------------COMMENT
MEDIUMcontrib/ossec2mysql.pl50# ---------------------------------------------------------------------------COMMENT
MEDIUMcontrib/ossec2mysql.pl52# ---------------------------------------------------------------------------COMMENT
MEDIUMcontrib/ossec2mysql.pl113# ---------------------------------------------------------------------------COMMENT
MEDIUMcontrib/ossec2mysql.pl115# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysqld.pl6# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysqld.pl11## ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysqld.pl13# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysqld.pl15# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysqld.pl17# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysqld.pl23# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysqld.pl25# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysqld.pl31# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysqld.pl33# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysqld.pl69# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysqld.pl71# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysqld.pl78# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysqld.pl80# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossec2mysqld.pl82# ---------------------------------------------------------------------------COMMENT
MEDIUMcontrib/ossec2mysqld.pl51# ---------------------------------------------------------------------------COMMENT
MEDIUMcontrib/ossec2mysqld.pl53# ---------------------------------------------------------------------------COMMENT
MEDIUMcontrib/ossec2mysqld.pl114# ---------------------------------------------------------------------------COMMENT
MEDIUMcontrib/ossec2mysqld.pl116# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossectop.pl6# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossectop.pl11# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossectop.pl13# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossectop.pl29# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossectop.pl31# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossectop.pl38# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossectop.pl40# ---------------------------------------------------------------------------COMMENT
MEDIUM⚡contrib/ossectop.pl42# ---------------------------------------------------------------------------COMMENT
MEDIUMcontrib/ossectop.pl59# ---------------------------------------------------------------------------COMMENT
MEDIUMcontrib/ossectop.pl61# ---------------------------------------------------------------------------COMMENT
MEDIUMsrc/external/zlib-1.3.1/CMakeLists.txt88#============================================================================COMMENT
MEDIUMsrc/external/zlib-1.3.1/CMakeLists.txt90#============================================================================COMMENT
MEDIUMsrc/external/zlib-1.3.1/CMakeLists.txt197#============================================================================COMMENT
MEDIUMsrc/external/zlib-1.3.1/CMakeLists.txt199#============================================================================COMMENT
AI Response Leakage3 hits · 22 pts
SeverityFileLineSnippetContext
HIGH…ernal/zlib-1.3.1/contrib/dotzlib/DotZLib/GZipStream.cs263 /// <remarks>In this implementation, this method does nothing. This is because excessiveCOMMENT
HIGH…ernal/zlib-1.3.1/contrib/dotzlib/DotZLib/GZipStream.cs273 /// <remarks>In this implementation this property is not supported</remarks>COMMENT
HIGH…ernal/zlib-1.3.1/contrib/dotzlib/DotZLib/GZipStream.cs290 /// <remarks>In this implementation this property is not supported</remarks>COMMENT
Self-Referential Comments6 hits · 18 pts
SeverityFileLineSnippetContext
MEDIUMsrc/init/osx105-addusers.sh63# Creating the groups.COMMENT
MEDIUMsrc/init/osx105-addusers.sh73# Creating the users.COMMENT
MEDIUMsrc/external/zlib-1.3.1/os400/make.sh164# Create the OS/400 library if it does not exist.COMMENT
MEDIUMsrc/external/zlib-1.3.1/os400/make.sh172# Create the DOCS source file if it does not exist.COMMENT
MEDIUMsrc/external/zlib-1.3.1/os400/make.sh194# Create the OS/400 source program file for the C header files.COMMENT
MEDIUMsrc/external/zlib-1.3.1/os400/make.sh205# Create the IFS directory for the C header files.COMMENT
Redundant / Tautological Comments6 hits · 9 pts
SeverityFileLineSnippetContext
LOWcontrib/debian-packages/generate_ossec.sh72# Check if element is in an arrayCOMMENT
LOWactive-response/firewalls/ipfw.sh51 # Check if our table is setCOMMENT
LOWsrc/os_dbd/dbmake.sh11 # Check if mysql_config is installed to use itCOMMENT
LOWsrc/os_dbd/dbmake.sh48 # Check if pg_config is installed to use itCOMMENT
LOWsrc/external/zlib-1.3.1/os400/make.sh66# Set LINK to "YES" if the module has been compiled.COMMENT
LOWsrc/agentlessd/scripts/register_host.sh59 # Check if the password was suppliedCOMMENT
Excessive Try-Catch Wrapping4 hits · 5 pts
SeverityFileLineSnippetContext
MEDIUMcontrib/ossec_rules_list.py48 print ("Error: OSSEC rules directory does not appear to exist")CODE
LOWsrc/init/ossec-local.sh357except Exception:CODE
LOWsrc/init/ossec-server.sh372except Exception:CODE
LOWsrc/init/ossec-client.sh279except Exception:CODE
Modern AI Meta-Vocabulary1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMsrc/tests/regressions/README.md78# - Migration checklist: inventory multi-agent frequency rules → convert toCOMMENT
Fake / Example Data2 hits · 2 pts
SeverityFileLineSnippetContext
LOWsrc/os_maild/tests/mail_utils_test.c62 assert(mail_safe_envelope_value("user@example.com", dst, sizeof(dst)) == 0);CODE
LOWsrc/os_maild/tests/mail_utils_test.c63 assert(strcmp(dst, "user@example.com") == 0);CODE
Example Usage Blocks1 hit · 2 pts
SeverityFileLineSnippetContext
LOWsrc/os_dbd/upgrade-agent-1363-mysql.sql9# Usage:COMMENT