MD4 Overview of intrusion detection systems (IDS): Security monitoring with detection tools

Question 1

Telemetry

Answer 1

Telemetry is the collection and transmission of data for analysis. While logs record events occurring on systems, telemetry describes the data itself. For example, packet captures are considered network telemetry.

For security professionals, logs and telemetry are sources of evidence that can be used to answer questions during investigations.

Question 2

Intrusion detection system, or IDS.

Answer 2

IDS is an application that monitors activity and alerts on possible intrusions. This includes monitoring different parts of a system or network like an endpoint.

Question 3

Endpoint

Answer 3

An endpoint is any device connected on a network, such as a laptop, tablet, desktop computer, or a smartphone. Endpoints are entry points into a network, which makes them key targets for malicious actors looking to gain unauthorized access into a system.

Question 4

Host-based intrusion detection system

Answer 4

To monitor endpoints for threats or attacks, a host-based intrusion detection system can be used. It’s an application that monitors the activity of the host on which it’s installed. To clarify, a host is any device that communicates with other devices on a network, similar to an endpoint.

Host-based intrusion detection systems are installed as an agent on a single host, such as a laptop computer or a server. Depending on its configuration, host-based intrusion detection systems will monitor the host on which it’s installed to detect suspicious activity. Once something has been detected, it records output as logs and an alert gets generated.

Question 5

A network based intrusion detection system

Answer 5

A network-based intrusion detection system collects and analyzes network traffic and network data. Network-based intrusion detection systems work similar to packet sniffers because they analyze network traffic and network data on a specific point in the network.

It’s common to deploy multiple IDS sensors at different points in the network to achieve adequate visibility. When suspicious or unusual network activity is detected, the network-based intrusion detection system logs it and generates an alert. In this example, the network-based intrusion detection system is monitoring the traffic that’s both coming from and going to the internet.

Question 6

Intrusion detection systems use different types of detection methods.

Most common…

Signature analysis

Answer 6

Signature analysis is a detection method used to find events of interest. A signature specifies a set of rules that an IDS refers to when it monitors activity. If the activity matches the rules in the signature, the IDS logs it and sends out an alert. For example, a signature can be written to generate an alert if a failed login on a system happens three times in a row, which suggests a possible password attack.

Before alerts are generated, the activity must be logged. IDS technologies record the information of the devices, systems, and networks which they monitor as IDS logs. IDS logs can then be sent, stored, and analyzed in a centralized log repository like a SIEM.