IDS / IPS (intrusion detection and prevention)
IDS · IPS · IDPS · intrusion detection system · intrusion prevention system · network sensor · NIDS · HIDS
Systems that analyse network traffic or a machine’s activity to spot attacks: an IDS raises alerts, an IPS also blocks.
In practice
They combine signatures (patterns of known attacks) with anomaly detection (departures from normal behaviour). Placed inline, an IPS stops an attack in real time, but a false positive also blocks legitimate traffic, so teams often start in detection mode before switching blocking on. Widespread encryption limits what a network sensor can see, hence its complementarity with EDR. Sensors are also valuable in industrial environments, where agents often cannot be installed on controllers.
During the Log4Shell flaw in December 2021, CERT-FR published detection signatures for network sensors, while warning that attackers could evade them through obfuscation and that they produced false positives. The sensor helps spot attempts; only the patch protects.
