Intrusion Detection

Topics Discussed

Product Overview

The Host-based Intrusion Detection/Intrusion Prevention Service (IDS/IPS) provides an agent-based system that is installed on a Host for network traffic analysis and reporting based on policies defined by Armor. Armor utilizes an enterprise-class IDS/IPS application and deploys the application agent with the Armor Agent. The IDS/IPS agent registers with an Armor management console, which receives IDS/IPS events in real-time. IDS/IPS event details are available in the Armor Management Portal (AMP). Armor's IDS/IPS policies are designed to detect network based events.

Open

Armor's IDS/IPS, powered by the Armor's threat prevention and response platform, monitors your environment, and alerts you and our elite Armor Security Operations Center (SOC) experts to potential threats, allowing for a quick and accurate response. All event data collected by the Armor IDS/IPS is integrated with data collected by other security appliances under monitoring by Armor, and correlated to identify suspicious patterns and behavior. Unlike traditional service providers, our security experts in the SOC go beyond alerting to help your security team quickly respond to the threat and minimize risk it may pose.

You can use the Intrusion Detection System screen to view data from the host-based intrusion detection system (HIDS).

Intrusion Detection Systems (IDS) analyze network or host traffic and alert if that traffic matches signatures of known attacks. These events are correlated in our Security Information Event Management (SIEM) system, in combination with other security data, to alert on security threats.

This system provides an agent-based, intrusion detection service for network traffic analysis and reporting. Specifically, HIDS monitors for attack attempts.

Any observed attempts are delivered to Armor's advanced correlation engine for inspection and correlation with other collected logs.

Review Widgets

Understand Intrusion Detection System (IDS)

This section displays details for all IDS events detected over the past 7 days.

Enable Trend Sub-Agent

As a prerequisite to installing Intrusion Prevention Services, you must install the Trend sub-agent. Use the following commands to manage the Trend sub-agent.

Recommendation Scans

One of the features available in Agent 3.0 is Recommendation scans. Recommendation scans provide a good starting point for establishing a list of rules that you should implement. During a recommendation scan, the Armor Agent scans the operating system for installed applications, the Windows registry, open ports, and more. To take advantage of Recommendation scans, turn on Ongoing Recommendation scans in the Toolbox.

Install Trend Sub-Agent:

Uninstall Trend Sub-Agent:

Trend Sub-Agent Status:

Turn On Recommended Scans:

Turn Off Recommended Scans:

Schedule a Recommended Scan (Runs on Next Trend Sub-Agent Heartbeat):

Set Recommendation Scan Interval:

Get Recommendation Scan Interval:

Trend Sub-Agent Help

Restart Trend:

Enable Intrusion Prevention Service

Use the following commands to manage the Intrusion Detection service.

Turn On Detect Mode:

Turn On Prevent Mode:

Turn Off Prevent Mode:

IPS Status:

List of Available IPS Rules:

List of Assigned IPS Rules on Policy:

Assign IPS Rules:

Un-Assign IPS Rule:

Intrusion Detection Help

Export IDS Data

1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.

2. Click Intrusion Detection.

3. (Optional) Use the filter function to customize the data displayed.

4. Below the table, click CSV.

   • You have the option to export all of the data (All), or only the data that appears on the current screen (Current Set).

Log Search For Intrusion Detection

Users can search for HIDS events in Log Search. For instructions on how to access and use Log Search, please see our documentation here.

An example of HIDS logs can be seen below:

Open

For a full list of Log Search fields and descriptions, please visit our glossary here.