Knowledge / detection network acsc-glossary

Intrusion detection system (IDS)

Watches for unwanted activity and tells someone. Host or network. Alert without an owner is a screensaver.

An IDS is automation that spots malicious or unwanted activity. It can sit on a host or on the network. It detects. It does not, by itself, stop the packet.

Tune it or it will train your people to ignore it. Map alerts to a queue with an owner. IPS is the sibling that is allowed to block.

Fact source: ASD's ACSC glossary.