The following modules are currently available:

• cheesewire — offering Tripwire-like functionality;
• net_conns — monitors all network connections;
• procs — monitors root-privileged processes;
• open_files — looks at all open files;
• log_monitoring — ensures syslog-related logs have not been tampered with.

The following modules are in development or planned:

• all_procs — monitors all processes and their open files. Since manual configuration of such a module would be an almost impossible and perpetual task, the modules "learns" about the system, guided by configured rules.