todo docs: Integrate with host intrusion detection systems.

diff --git a/TODO b/TODO
index 66d3a5c..2c952b5 100644 (file)
--- a/TODO
+++ b/TODO
@@ -271,3 +271,15 @@ blocks they occupy.
 And vice versa.
 
 Is it even possible?
+
+Integration with host intrusion systems
+---------------------------------------
+
+Perfect way to monitor VMs from outside the VM.  Look for file
+hashes, log events, login/logout etc.
+
+http://www.ossec.net/
+http://la-samhna.de/samhain/
+http://sourceforge.net/projects/aide/
+http://osiris.shmoo.com/
+http://sourceforge.net/projects/tripwire/