Intrusion Detection and Prevention

A firewall decides what traffic is allowed in and out. An IDS or IPS goes a step further and inspects the content of that traffic, looking for signs of an attack in progress. Where a SIEM collects and correlates logs across your organisation, an IDS/IPS works at the network or host level and acts in real time.

IDS (Intrusion Detection System) monitors traffic and raises alerts when it detects suspicious patterns. It does not block anything on its own. IPS (Intrusion Prevention System) does the same but can also block or drop malicious traffic automatically as it is detected.

Deployment options

• Host-based (HIDS/HIPS) — installed directly on a server or workstation, monitoring activity at the operating system level.
• Network-based (NIDS/NIPS) — deployed at a network chokepoint to monitor all traffic passing through a segment.

We help you select, configure, and tune IDS/IPS solutions that fit your environment, and integrate them with your existing security infrastructure so alerts are actionable rather than noise.