An intrusion detection system (IDS) is a monitoring tool that watches network traffic or host activity for signs of malicious behavior and policy violations, then raises alerts for analysts to review. The key point that trips people up is simple: an IDS observes and reports, it does not block. That distinction separates it from a firewall or an intrusion prevention system.
A network based IDS (NIDS) watches traffic on a segment, while a host based IDS (HIDS) watches a single system, including its files and logs. Detection can be signature based, matching known attack patterns, anomaly based, flagging deviations from a learned baseline, or behavior based. Each approach has a weakness worth knowing. Signatures miss novel attacks, and anomaly detection generates false positives that can bury a real event, so tuning and skilled analysts matter as much as the sensor itself.
Why does an IDS matter for the CISSP exam?
An IDS belongs to Domain 4: Communication and Network Security, worth 13 percent of the exam, and it also supports monitoring work in Security Operations. Know the IDS versus IPS difference, the detection methods, and placement choices.
NIST covers the topic in SP 800-94, Guide to Intrusion Detection and Prevention Systems.