## Intrusion Detection Systems (IDS): The Burglar Alarm

If EDR protects the endpoint (the house) and SIEM watches the logs (the diary), the **IDS** watches the wire (the roads leading to the house). It analyzes network packets in real-time to find attacks.

### NIDS vs. HIDS
There are two main flavors of IDS:

#### 1. Network IDS (NIDS)
*   **Location**: Sits on the network, usually behind the firewall or plugged into a Switch Span Port (Mirror Port).
*   **Visibility**: Sees all traffic flowing through that segment.
*   **Blind Spot**: It cannot see *encrypted* traffic (HTTPS) unless you are doing SSL Decryption (man-in-the-middle). It also can't see what happens inside the host (e.g., USB insertion).
*   **Examples**: Snort, Suricata, Zeek (Bro).

#### 2. Host IDS (HIDS)
*   **Location**: Installed on the server/laptop itself (Software Agent).
*   **Visibility**: Sees file changes, log entries, and memory. Crucially, it sees traffic *after* it has been decrypted by the web server.
*   **Blind Spot**: If the OS is compromised (Rootkit), the HIDS might be disabled or lied to.
*   **Examples**: OSSEC, Wazuh Agent (which includes HIDS), Tripwire.

### IDS vs. IPS (Detection vs. Prevention)
*   **IDS (Intrusion Detection System)**:
    *   **Mode**: Passive.
    *   **Action**: "I see an attack. I will send an alert to the SIEM."
    *   **Traffic**: It receives a *copy* of the traffic (Tap). It does not slow down the network.
*   **IPS (Intrusion Prevention System)**:
    *   **Mode**: Inline (Active).
    *   **Action**: "I see an attack. I am dropping the packet immediately."
    *   **Traffic**: All traffic flows *through* it. If the IPS crashes, the network goes down (unless you have fail-open hardware).

### Why use IDS if we have Firewalls?
*   **Firewall**: Blocks based on Rules (IP, Port). "Allow Port 80."
*   **IDS**: Inspects the *content* of the packet on Port 80. "Is this request asking for `index.html` (Good) or is it sending `Union Select 1,2,3...` (SQL Injection)?"

A Firewall is the Bouncer who checks ID. The IDS is the Security Guard watching the dance floor for fights.