IDS/IPS (Intrusion Detection/Prevention System)
Definition
Network or host-based systems that inspect traffic or system calls for known attack patterns. An IDS generates alerts without blocking; an IPS sits inline and can drop malicious traffic. The distinction matters for tuning: prevention mode can block legitimate activity if rules are misconfigured.
- IDS action
- Inspects traffic or syscalls, alerts only
- IPS action
- Inline, can drop malicious traffic
- Deployment forms
- Network-based and host-based
- Detection basis
- Known attack pattern signatures
- Tuning risk
- Misconfigured prevention mode can block legitimate activity
Common questions
What is the practical downside of running a system in prevention (IPS) mode?+
Because it sits inline and drops traffic automatically, a poorly tuned rule or an unexpected but legitimate pattern can be blocked outright, causing an outage. This is why organisations often stage new signatures in alert-only mode before enabling blocking.
Does signature-based IDS/IPS catch novel attacks it has never seen before?+
Not reliably. Signature matching depends on known attack patterns, so a genuinely new technique can pass through undetected until the vendor or analyst writes a new signature, which is why signature systems are usually paired with anomaly-based or behavioural detection.
Related terms
- Alert Correlation
- The process of grouping multiple related events or alerts into a single higher-level alert representing one attack sequence. A correlation rule might...
- Alert Fatigue
- The condition in which analysts receive more alerts than they can meaningfully review, leading to delayed responses, dismissed true positives, and reduced...
- EDR (Endpoint Detection and Response)
- An agent-based security tool deployed on individual endpoints (workstations, servers, mobile devices) that monitors process execution, file changes, network connections, and registry...
- Indicator of Compromise (IoC)
- An observable artefact that suggests a system has been involved in a malicious event. Static analysis produces file-based IoCs: cryptographic hashes, embedded...
- SIEM (Security Information and Event Management)
- A platform that aggregates log and event data from systems, networks, and applications across an environment, correlates events against detection rules, generates...