Intrusion detection and prevention system

An intrusion detection system (IDS) watches traffic or system activity and raises an alert when it sees something that matches an attack. An intrusion prevention system (IPS) sits in the path of the traffic and can drop or reset malicious connections as well. NIST groups both as intrusion detection and prevention systems (IDPS).

They are usually described along two axes. Where they watch: network-based systems inspect traffic on a network segment, while host-based systems run on individual machines. How they decide: signature-based detection matches known attack patterns, while anomaly-based detection flags behavior that deviates from a baseline. Snort and Suricata are widely used open-source network IDS/IPS engines, and next-generation firewalls often include IPS features.

Example

A Suricata sensor on the server network matches a rule for a known exploit against a web application and alerts the SOC with the source IP, destination and payload. In IPS mode, the same rule drops the malicious request before it reaches the server.

Why it matters for a SOC analyst

IDS alerts tell you that something tried, not that it worked, so the next step is checking the target: was it vulnerable, and what did it do afterwards? Signature rules need tuning to avoid floods of false positives, and encrypted traffic limits what network sensors can see, which is why IDS data works best alongside EDR and server logs.