🚨
Intrusion Detection System (IDS)
Security
Detection system analyzing traffic/logs to identify threats; provides alerts rather than blocking.
Definition
An IDS inspects network traffic or host activity to detect signs of compromise using signatures, anomaly detection, and rules. It complements firewalls and incident response.
In plain English
Detection system analyzing traffic/logs to identify threats; provides alerts rather than blocking.
Why this matters
Why it matters: Detection reduces dwell time and limits data exposure during incidents.
Example
Example: Tune alerts for brute-force attempts, suspicious DNS, and abnormal outbound traffic; integrate alerts into a SIEM.