> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/intrusion-detection-system.md).

# Intrusion Detection System

With Enginsight's Intrusion Detection System (IDS), you can monitor network traffic on all hosts on which a [Pulsar was installed](/docs/manual/english/installation-and-configuration/installation-and-configuration/enginsight-components/pulsar.md) to detect attacks, misuse, and violations of security policies. In combination with the [Shield feature](/docs/manual/english/platform-usage/shield.md), Enginsight's Intrusion Prevention System (IPS), detected network attacks can also be prevented automatically.

To detect network anomalies and attacks, system and network activities are analyzed using several thousand predefined rules, primarily Snort Community Rules, and are shown in the Enginsight platform.

The Enginsight IDS provides a [tiered detection system](/docs/manual/english/platform-usage/hosts/management/policy-manager/add-policy-manager.md#enginsight-intrusion-detection-system-ids) with 5 levels, which allows you to configure an individual balance between performance and security.

***

## Requirements

**Enabling the IDS**

To detect network anomalies and, based on this, block network attacks using Shield, the following settings must be configured:

* The *detection* of network anomalies must be enabled in the [settings of the individual hosts](/docs/manual/english/platform-usage/host-detail-view/settings.md#core-feature) or under **Hosts** → **Policies** using a [corresponding policy](/docs/manual/english/platform-usage/hosts/management/policy-manager/add-policy-manager.md#enginsight-intrusion-detection-system-ids).
* The *blocking* of network attacks must be enabled in the [settings of the individual hosts](/docs/manual/english/platform-usage/host-detail-view/settings.md#core-feature) or under **Hosts** → **Policies** using a [corresponding policy](/docs/manual/english/platform-usage/hosts/management/policy-manager/add-policy-manager.md#enginsight-shield-ips).

***

## Important Notes

* After the IDS was enabled, it first learns the underlying IT infrastructure. During this learning phase, false-positive detections may occur more frequently. We recommend that you use this period to identify legitimate network traffic and non-critical activities that are detected as suspicious and, if necessary, add them to the [whitelist](/docs/manual/english/platform-usage/hosts/intrusion-detection-system/whitelist.md).
* When you add whitelist entries, make sure that the exceptions are as precise as possible. We recommend that you not create overly broad whitelist entries, as these undermine the security purpose of the IDS, similar to an "any any" firewall rule.

**Snort Community Rules**

* Enginsight supports the detection of attacks described in the [Snort](https://www.snort.org/) Community Rules. These also include more specific attacks, such as attacks against Microsoft IIS or Exchange Server, attempts to access sensitive data on a web server, or Common Gateway Interface (CGI) attacks.
* The Snort Community Rules in use are licensed under the [GPLv2 license](https://www.snort.org/gpl).
* The Snort Community Rules are updated automatically every 24 hours.

***

## IDS: Menu Structure

Under **Hosts** → **Intrusion Detection System**, you can find various options for detecting and responding to network anomalies and network attacks in real time.

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Intrusion Detection System** menu item to expand or collapse the corresponding submenu.

The following submenu items are available:

{% columns %}
{% column width="33.33333333333333%" %}

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2Fo1FnopWOqcK702oVOn4g%2FEnginsight-EN-Menu-Hosts-IDS.jpg?alt=media&amp;token=6320400c-30e9-4d8a-ba5a-3a5db171bb15" alt=""><figcaption></figcaption></figure>
{% endcolumn %}

{% column width="66.66666666666667%" %}

* [Dashboard](/docs/manual/english/platform-usage/hosts/intrusion-detection-system/dashboard.md)
* [Network Anomalies](/docs/manual/english/platform-usage/hosts/intrusion-detection-system/network-anomalies.md)
* [Whitelist](/docs/manual/english/platform-usage/hosts/intrusion-detection-system/whitelist.md)
* [World Map](/docs/manual/english/platform-usage/hosts/intrusion-detection-system/world-map.md)
  {% endcolumn %}
  {% endcolumns %}

<i class="fa-grip-dots-vertical">:grip-dots-vertical:</i> Click and hold the **Intrusion Detection System** menu item to move it, including all submenu items, within the menu tree using drag and drop.

***

## Further Resources

**Knowledge Base**

* [How can I prevent performance issues with the Enginsight IDS on Windows systems?](https://docs.enginsight.com/docs/knowledge-base/english/intrusion-detection-system-ids/how-can-i-prevent-performance-issues-with-the-enginsight-ids-on-windows-systems)
* [What types of network attacks does the Enginsight IDS detect?](https://docs.enginsight.com/docs/knowledge-base/english/intrusion-detection-system-ids/what-types-of-network-attacks-does-the-enginsight-ids-detect)

***