What is an intrusion detection system (IDS)?

How it works

1. In this glossary, the name is used for a product or function that watches a network or a device for signs of a security incident.
2. NCSC 10 Steps guidance on logging and monitoring says organisations should design systems so that incidents can be detected and investigated. ¹
3. Collecting logs is described as the foundation of security, or protective, monitoring. Security monitoring means actively analysing logs for signs of known attacks or unusual behaviour. The organisation can then detect a possible incident and respond. ¹

What UK guidance says

The NCSC logging and monitoring page, and the Security Operations Centre collection, are written for organisation readers. This page explains the term only. It does not give steps, tools, signs or product advice. ¹²

Frequently asked questions

What is an intrusion detection system?

In this glossary, it is a product or function that watches a network or a device for signs of a security incident.

What does IDS stand for, in this cyber-security sense?

Intrusion detection system. Other uses of the letters IDS are not covered here.

How does this relate to logging and security monitoring?

NCSC says organisations should design systems so that incidents can be detected and investigated. Collecting logs is described as the foundation of security, or protective, monitoring. Security monitoring means actively analysing logs for signs of known attacks or unusual behaviour. ¹