🔍 Automated Security Tools
IDS, IPS, SIEM, and NetFlow — the automated eyes of a defender⏱ ~2 min
A hospital patient has continuous monitoring: heart rate, blood pressure, oxygen. When any reading goes outside normal range, an alarm sounds immediately. Without monitoring, problems are only discovered when someone collapses. Network security devices do the same: continuously monitoring traffic, logging events, and alerting when patterns indicate an attack. Without them, a breach might not be discovered for 200+ days.
Core Security Detection Devices
| Device | Abbreviation | Function | Active or Passive? | Placement |
|---|---|---|---|---|
| Intrusion Detection System | IDS/NIDS | Monitors traffic and alerts when it matches attack signatures or anomalies. Does NOT block. | Passive (alert only) | Span/mirror port — sees copy of traffic; not inline |
| Intrusion Prevention System | IPS/NIPS | Same as IDS but can actively drop malicious packets in real time | Active (can block) | Inline — all traffic flows through it |
| Host-Based IDS/IPS | HIDS/HIPS | Runs on individual endpoints; monitors local events, file changes, process activity | Both modes | On each endpoint (laptop, server) |
| Security Information & Event Management | SIEM | Aggregates logs from all devices; correlates events across the network to detect attack patterns that span multiple systems | Passive (analysis) | Central server receiving logs from all devices |
| NetFlow Analyzer | — | Collects IP flow records (who talked to whom, how much, when) without full packet capture | Passive (metadata only) | On routers and core switches |
How Logs Work — Reading a Log Entry
Every security device generates log entries. A single log entry answers: who (source IP/user), what (action taken), when (timestamp), where (destination), and outcome (success/failure). The power of a SIEM is correlating events across many devices — a single failed login is normal; 500 failed logins in 30 seconds from one IP is a brute-force attack.
IDS vs IPS — The Critical Tradeoff
- •Passively monitors traffic on a mirror port
- •Generates alerts when attacks detected
- •Human analyst investigates and responds
- •✅ No false-positive blocking of legitimate traffic
- •✅ Attacker doesn't know they're being watched
- •❌ Attack completes before human can respond
- •Best for: environments where false positives are costly
- •Sits inline; all traffic flows through it
- •Drops malicious packets in real time
- •Attack is stopped immediately, before impact
- •✅ Stops fast-moving automated attacks
- •❌ False positives block legitimate traffic
- •❌ Inline placement = potential bottleneck
- •Best for: high-confidence signatures; known bad traffic
A network analyst sees these log entries in the SIEM: • 02:14:01 — IDS alert: port scan from 192.168.50.99 • 02:14:45 — Firewall: 192.168.50.99 attempted connections to ports 22, 23, 80, 443, 3389 on 10 internal hosts • 02:15:12 — Authentication server: 5 failed SSH logins from 192.168.50.99 • 02:15:30 — Authentication server: successful SSH login from 192.168.50.99 What attack sequence does this represent, and what should the analyst do first?