Defensive Security (Blue Team) / Detection
Lesson 21 of 32
Intrusion detection
IDS tools like Suricata and Zeek watch network traffic for known bad patterns and odd behaviour. An IPS can block it too.
Key points
- IDS detects, IPS blocks
- Suricata uses rules
- Zeek writes rich connection logs
Quiz · +10 XP
What is the difference between an IDS and an IPS?
Log in to save progress and earn XP.