Industrial Cybersecurity

Network intrusion detection logs

An intrusion detection system (IDS) is a hardware device or software application (VM) that monitors a network or group of systems for malicious activity or policy violations. Any detected activity or violation is reported to either an administrator or collected centrally using a security information and event management (SIEM) system.

Most firewall appliances come with an IDS built in, such as Sourcefire for the Cisco ASA firewall and Palo Alto Threat detection services, built into select PA firewalls. These systems can provide tons of security-related information on perimeter network traffic flowing between the security zones. IDS logs should be centrally stored on an SIEM server to add valuable information ...