IDS

Monitors traffic or hosts and alerts on suspected malicious activity.

An IDS inspects network or host activity and raises alerts when it observes suspicious or known malicious patterns, but it does not block traffic on its own. Detection uses signature based matching for known threats or anomaly based modeling to flag deviations from a baseline. Because it only reports, it is often deployed passively on a mirrored port. The key exam contrast is the IPS, which sits inline and can actively drop offending traffic, trading the risk of false positives blocking legitimate activity.