thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Foundational

Intrusion Detection System (IDS)

System that monitors network or host activity and alerts on suspicious or malicious behavior without blocking it.

Definition

IDS can be network-based (NIDS) monitoring copies of traffic from a SPAN port or tap, or host-based (HIDS) monitoring logs, files, and processes. Detection methods include signature-based, anomaly-based, and heuristic analysis. Because it is passive and out of band, it cannot stop attacks itself.

Example

Zeek or Snort in IDS mode analyzes traffic mirrored from a core switch and sends alerts to the SIEM.

Exam tip

IDS is passive and detective; IPS is inline and preventive.

Don't confuse it with

Related terms