To fully use this screen, you must add the following permission to your account:
- Read IDS
You can use the Intrusion Detection System screen to view data from the host-based intrusion detection system (HIDS).
Intrusion Detection Systems (IDS) analyze network or host traffic and alert if that traffic matches signatures of known attacks. These events are correlated in our Security Information Event Management (SIEM) system, in combination with other security data, to alert on security threats.
This system provides an agent-based, intrusion detection service for network traffic analysis and reporting. Specifically, HIDS monitors for attack attempts.
HIDS policies focus on detecting OWASP top 10 events. Any observed attempts are delivered to Armor's advanced correlation engine for inspection and correlation with other collected logs.
Review Widgets
| Widget | Description |
|---|---|
| Top Signatures | This widget displays the top 10 IDS events detected over the past 7 days, grouped together by signature. |
| Top VMs | This widget displays the top 10 IDS events detected over the past 7 days, grouped together by virtual machine. |
Understand Intrusion Detection System (IDS)
This section displays details for all IDS events detected over the past 7 days.
| Column | Description |
|---|---|
| Name | This column displays the name of your virtual machine. |
| Source IP | This column displays the IP address of the signature. |
| Source Port | This column displays the port address of the signature. |
| Destination IP | This column displays the IP address of your virtual machine. |
| Destination Port | This column displays the port address of your virtual machine. |
| Event Signature | This column displays the the content of the signature. |
| Event Timestamp | This column displays the time and date when the event signature was detected. |
| Count | This column displays the number of event signatures that were detected. |
Export IDS Data
- In the Armor Management Portal (AMP), in the left-side navigation, click Security.
- Click Intrusion Detection.
- (Optional) Use the filter function to customize the data displayed.
- Below the table, click CSV.
- You have the option to export all of the data (All), or only the data that appears on the current screen (Current Set).