Snort, Proofpoint Advanced Threat Protection, Palo Alto Networks Threat Protection, Palo Alto Networks URL Filtering PAN-DB, Cisco Firepower NGIPS (formerly Sourcefire 3D), Trend Micro TippingPoint Threat Protection System (TPS), Intrusion Detection, part of Alert Logic Professional, Cisco IPS Sensor (Discontinued), McAfee Network Security Platform, and NETSCOUT AirMagnet Enterprise.
Intrusion detection systems (IDS) are software products that monitor network or system activities, and analyze them for signs of any violations of policy, acceptable use, or standard security practices. They then report any malicious activities or policy violations to system administrators.
IDS are often part of a broader digital security posture. Larger organizations and enterprises in particular will integrate intrusion detection systems into their security information and event management (SIEM) system. This integration is key at centralizing security alerts and management processes to make the business’s security systems more manageable.
A key benefit of intrusion detection systems is that they serve as an adaptable front line in a broader security alerting and management structure, particularly at enterprises with the resources and needs to maintain multiple lines of security. IDS also log suspected intrusion activity, which creates a paper trail that can be helpful for legal and regulatory reasons in some circumstances.
A common challenge for intrusion detection systems is the prevalence of false positives. IDSs tend to identify a lot of false positives in order to make sure that no intrusions slip by undetected. A key challenge and differentiator among IDSs is their ability to continually manage and reduce instances of false positives without compromising the core security offering of the product.
There has been an evolution in the IDS market to include a more “advanced” tier of systems that include prevention features specifically. Intrusion detection systems are concerned primarily with identifying potential incidents and logging information about them and notifying administrators of observed events.
However some systems, usually called instruction prevention systems, actively try to prevent intrusion threats from succeeding. They can do so by blocking traffic to or from certain IP addresses or block specific packets until an IT administrator validates it. The specific features offered will vary by product. As the market evolves, intrusion detection and prevention will likely converge into a single product as the norm, rather than the exception. Currently, there are still a large number of products that specialize into one or the other functionality.
There are two main types of intrusion detection systems:
Network-based systems: Network-based systems monitor network traffic for network segments or devices to identify suspicious activity
Host-based systems: Host-based systems monitor the characteristics of a single host, such as a computer, and events occurring within that host
When comparing intrusion detection systems, consider these factors:
Detection vs. Prevention Focus: Some IDS providers have expanded to include more native prevention capabilities as well. These features can be very helpful, but some with additional up front and overhead costs to manage. Consider whether native intervention tools are necessary and whether there are preexisting tools in the organization that can serve that purpose already.
Integrations with InfoSec Tech Stack: How well does each product integrate with the other network and application security products the organization uses? Consider reviewers’ experiences with those specific integrations, as well as any information vendors can provide about specific use cases.
Standalone IDS vs. Security Platform: Security technology has been trending towards unification and centralization for years. Consider whether it is more helpful to the enterprise to have a standalone, specialized tool for intrusion detection, or adopt a larger security platform that bundles intrusion detection with other features like firewalls or SIEM systems.
Intrusion detection systems will vary in price depending on whether it is a standalone system or part of a larger security suite. In the former case, standalone systems start at $1,000-2,000 and can scale up to $10,000+.
(1-25 of 45) Sorted by Most Reviews
AlienVault® Unified Security Management® (USM) delivers threat detection, incident response, and compliance management in one unified platform. It is designed to combine all the essential security capabilities needed for effective security monitoring across cloud and on-premises…
CrowdStrike offers the Falcon Endpoint Protection suite, an antivirus and endpoint protection system emphasizing threat detection, machine learning malware detection, and signature free updating. Additionally the available Falcon Spotlight module delivers vulnerability assessment…
OSSIM leverages the power of the AlienVault Open Threat Exchange by allowing users to both contribute and receive real-time information about malicious hosts. AlienVault OSSIM is an open source Security Information and Event Management (SIEM) product. It is a unified platform providing:…
Juniper SRX is a firewall offering. It provides a variety of modular features, scaled for enterprise-level use, based on a 3-in-1 OS that enables routing, switching, and security in each product.
Proofpoint Advanced Threat Detection is a suite of threat detection products including Attack Protection for Email, SaaS applications, Mobile Defense, Threat Response, and Threat Intelligence.
Cisco Firepower Next-Generation Intrusion Prevention System (NGIPS) is an intrusion detection response system that produces security data and enhances the analysis by InsightOps. The technology replaces the former Sourcefire 3D IPS. Cisco acquired Sourcefire in 2013.
RackFoundry Total Security Management offers a complete firewall solution. It includes VPN, SIEM, automated vulnerability scanning and log management features scaled for SME’s.
Alert Logic's Network Intrusion Detection System (IDS), formerly available as Alert Logic Threat Manager, SIEMlessly detects and responds to threats with the company's Intrusion Detection System software, now available as part of the Professional & Enterprise tiers of Alert Logic'…
The majority of attacks and exposure to malicious content occurs during the normal course of web browsing activities, which requires the ability to allow safe, secure web access for all users. URL Filtering with PAN-DB automatically prevents attacks that leverage the web…
McAfee Network Security Platform is an intrusion detection and prevention system (IDPS).
Powertech Exit Point Manager for IBM i from HelpSystems allows users to reduce the risk of unauthorized and unaudited server access with system access monitoring, tracking and control software for IBM i.
The TippingPoint Threat Protection System (TPS) from Trend Micro is an intrusion detection and prevention system.
Threats do not discriminate between application delivery vectors, requiring an approach that has full visibility into all application traffic, including SSL encrypted content, with full user context. Threat Prevention leverages the visibility of our next-generation firewall…
IBM Security Network IPS is an intrusion detection and prevention system.
Juniper IDP and the Juniper NetScreen IDP appliances, from Juniper Networks, were a product line providing security and intrusion detection / prevention. They reached end of life in 2018 and are no longer made or supported.
Fidelis Cybersecurity offers Elevate, the company's flagship threat prevention and detection platform that encompasses three modules, Fidelis Network Module which provides threat detection and network visibility, Fidelis Deception which is based on technology acquired with TopSpin…
LookingGlass Cyber Solutions is a threat protection solution protecting against cyber attacks to global enterprises and government agencies The product is augmented by a team of security analysts who enrich the data feeds and provide timely insights to customers of potential risks.…
OPSWAT Metadefender is a vulnerability management security product comprising vulnerability assessment, data cleansing, malware engines, and customized security policies.
Illusive Networks, headquartered in Tel Aviv, offers the Illusive Deception Management System, which uses machine learning to predict cyber attack vectors and, in an unusual approach, introduce deceptions across the network to confuse, frustrate, and ultimately thwart attackers.
Ziften in Austin, Texas offers Zenith, an application dedicated to providing visibility into user application activity across all managed devices for the purpose of intrusion and malicious behavior detection.
F-Secure offers Rapid Detection Service, their flagship intrusion detection platform featuring live support and observation of activity for anomalies and potential threats.
NETSCOUT AirMagnet Enterprise is a 24x7 Performance Monitoring & Wireless Intrusion Detection System (WIDS) / Prevention System (WIPS) that enables organizations to meet security, performance and compliance demands of today’s mobile workforce. AirMagnet Enterprise can perform network…
