Dictionary · Defensive Security
IDS
IDS — Intrusion Detection System
Detection · Beginner
A system that watches traffic or host activity and raises an alert when something matches a suspicious pattern. It detects; it does not automatically block.
It is an alarm, not a lock. Someone or another system still has to decide what to do with the alert. Placement matters, because it can see only the traffic that passes its sensor.
Picture it
The sensor raises an alert. It does not automatically block, and an alert is a prompt to look, not proof of a compromise.
Example: A network sensor alerts when a scan sweeps every port on a server VLAN. An analyst confirms the source before anyone changes a firewall rule.
Common misconception
- An alert is not proof of a compromise. It is a prompt to look.