# What is an Intrusion Detection System (IDS)?

> An intrusion detection system (IDS) monitors network, host, wireless, application, or other events and analyzes them for signs of possible incidents or policy violations.

- Canonical URL: https://yellowcube.eu/glossary/intrusion-detection-system/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It records or reports suspicious activity so people or automated workflows can investigate. An IDS may observe traffic directly, receive mirrored data, or analyze events generated on a protected system.

Detection may compare activity with known signatures, protocol rules, expected behavior, or statistical and contextual baselines. A network IDS needs visibility into the relevant path; a host IDS can observe local processes, files, logs, or system calls. Useful alerts preserve enough time, source, rule, and event context for triage and correlation.

### Key points

- **Coverage design:** Define which assets, paths, protocols, events, and attack stages each sensor can observe, including cloud, remote, encrypted, and internal traffic.
- **Detection operations:** Maintain detection content, baseline expected behavior, tune noisy rules, protect sensors and management channels, and test whether representative activity produces usable evidence.
- **Alert handling:** Assign severity and ownership, correlate with identity, endpoint, application, and threat evidence, and document when an alert should trigger containment or escalation.
- **Important limitation:** An IDS reports evidence, not certainty. False positives and false negatives can occur; evasion, encryption, dropped packets, missing logs, and blind spots can reduce or distort the evidence. A quiet IDS does not prove that no intrusion occurred.

### Related terms

[Intrusion prevention system (IPS)](<https://yellowcube.eu/glossary/intrusion-prevention-system/>) · [Network detection and response (NDR)](<https://yellowcube.eu/glossary/network-detection-and-response/>) · [Security telemetry](<https://yellowcube.eu/glossary/security-telemetry/>) · [Network traffic](<https://yellowcube.eu/glossary/network-traffic/>) · [Security information and event management (SIEM)](<https://yellowcube.eu/glossary/security-information-and-event-management/>)

### Sources

[NIST glossary: Intrusion Detection System](https://csrc.nist.gov/glossary/term/intrusion_detection_system) · [NIST SP 800-94: Guide to Intrusion Detection and Prevention Systems](https://csrc.nist.gov/pubs/sp/800/94/final) · [NIST SP 800-82r3: Guide to Operational Technology Security](https://csrc.nist.gov/pubs/sp/800/82/r3/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.