Definition
An Intrusion Detection System (IDS) is a security tool that monitors network traffic or system activities for malicious actions or policy violations. It analyzes data against a database of known threats or established baseline behaviors to identify suspicious patterns. When a potential threat is detected, the IDS generates an alert, notifying security personnel to investigate further. For instance, an IDS might flag a sudden surge of login attempts from an unfamiliar IP address as a brute force attack. Unlike an Intrusion Prevention System (IPS), an IDS typically only detects and alerts, it does not automatically block the suspicious activity. Understanding IDS is crucial for roles covered by CompTIA Security+, CySA+, and CISSP certifications.