So I have only used OSSEC, so im not sure what it can do, but I do know that Wazuh has modules that support it.