IDS, IPS or NDR: which intrusion detection fits your environment?

Recommended detection layers

Ranked for your answers. Every point for or against is shown.

1. 1

   Cloud-native network detection

   Start here

   Provider services that analyse flow logs, DNS and control-plane logs, plus managed firewalls with IDS/IPS rules and traffic mirroring for your own sensors.

   • + You run cloud workloads; provider detection needs no sensors and covers every account once enabled.
   • + AWS: GuardDuty reads VPC Flow Logs, DNS and CloudTrail on its own stream; AWS Network Firewall adds Suricata-compatible IPS rules.
   • + Managed services suit a small team: no sensor upkeep.

   Flow logs carry no payload. For signature detection on a workload, mirror its traffic to a sensor or route it through a managed IPS.

   Trade-offs, placement and examples

   Sees: Traffic metadata and API activity across accounts and regions with no sensors to run.

   Misses: Flow logs carry no payload, so signature detection needs mirroring or a managed IPS. Coverage differs per provider.

   Where: Enabled in every account and region; managed IPS on internet and inter-VPC egress; mirroring only for high-value workloads.

   Open source: Suricata or Zeek on mirrored traffic (AWS Traffic Mirroring, Google Cloud Packet Mirroring)

   Commercial examples: AWS GuardDuty and AWS Network Firewall (Suricata-compatible rules); Azure Firewall Premium IDPS and Microsoft Defender for Cloud; Google Cloud IDS (detection-only, Palo Alto Networks technology)

   Source: AWS, AWS, AWS, AWS, Microsoft, Google Cloud

2. 2

   Network detection and response (NDR)

   Strong fit

   Passive sensors plus behavioural analytics over flow and protocol metadata, with investigation and response workflows. NIST calls the analytics part network behavior analysis.

   • + Attackers who get past the edge move laterally; NDR is the layer that watches east-west traffic.
   • + Much of your traffic is encrypted, and NDR works from metadata (TLS fingerprints, certificates, DNS, timing) that stays useful.
   • + At your traffic volume, behaviour analytics finds patterns that individual alerts miss.
   • + NDR covers the devices EDR cannot (printers, IoT, appliances, unmanaged machines) and corroborates EDR detections.
   • + Hybrid networks have the most east-west paths to watch.

   Trade-offs, placement and examples

   Sees: Lateral movement, beaconing, unusual data transfers and new devices, from metadata that stays useful when payloads are encrypted (TLS fingerprints, certificates, DNS, timing, volumes).

   Misses: Exact payload content in encrypted sessions; it needs tuning time and analyst attention to pay off.

   Where: East-west at the core and data-centre spines, plus the edge, fed by TAPs or mirroring.

   Open source: Zeek (the log engine many NDR products build on); Security Onion; Malcolm

   Commercial examples: Vectra AI; ExtraHop RevealX; Darktrace; Corelight (Zeek-based); Cisco Secure Network Analytics

   Source: NIST, Zeek Project, Security Onion Solutions, CISA / Idaho National Laboratory

3. 3

   Intrusion prevention (inline IPS)

   Worth adding

   The same detection engine placed inline so it can drop or reset matching traffic, usually as a feature of a next-generation firewall.

   • + Inline blocking for some segments: start in alert mode and enable blocking rule by rule.
   • + Your edge firewalls probably already have an IPS feature to license or switch on.
   • + Managed cloud firewalls offer IPS rules without running appliances (AWS Network Firewall, Azure Firewall Premium).

   With most traffic encrypted, an IPS without TLS inspection mainly blocks on addresses, domains and certificates, not payload.

   Trade-offs, placement and examples

   Sees: Traffic crossing the choke point it sits on.

   Misses: East-west traffic that never crosses it; encrypted payloads unless it decrypts. A false positive blocks real traffic.

   Where: Inline at the internet edge and between trust zones, starting in alert-only mode and moving rules to block once tuned.

   Open source: Suricata in IPS mode; Snort 3 inline

   Commercial examples: IPS features of next-generation firewalls (for example Palo Alto Networks, Fortinet FortiGate, Cisco Secure Firewall, Check Point)

   Source: NIST, OISF, Cisco

4. 4

   Host-based IDS (HIDS)

   Worth adding

   An agent on each server or endpoint that watches logs, file changes, registry and processes on that machine.

   • + Every environment needs visibility on the hosts that hold the data.
   • − You already run EDR, which covers most HIDS detections on endpoints; keep HIDS for file integrity on servers and hosts EDR does not cover.
   • + An agent works the same on cloud VMs as on-premises, with no traffic mirroring needed.

   Trade-offs, placement and examples

   Sees: What happened on the host after decryption: file integrity changes, log-in activity, privilege changes, rootkits.

   Misses: Hosts without the agent (appliances, IoT, OT, unmanaged devices) and traffic between other machines.

   Where: On servers first (especially ones holding regulated data), then endpoints not already covered by EDR.

   Open source: Wazuh; OSSEC

   Commercial examples: File integrity and host detection features in EDR suites (for example Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne)

   Source: NIST, Wazuh, OSSEC

5. 5

   Network IDS (passive NIDS)

   Not a priority

   A sensor that receives a copy of traffic (SPAN port, network TAP or cloud traffic mirroring) and alerts on signatures and protocol anomalies.

   • + You own network segments you can tap or mirror.
   • − Over 80% encrypted: signatures see little payload without decryption, so expect value mainly from metadata, DNS and cleartext internal protocols.

   Trade-offs, placement and examples

   Sees: Every device on the monitored segment, including ones that cannot run an agent; exploit attempts, scans, known-bad indicators in cleartext.

   Misses: Payload inside encrypted traffic unless decrypted; segments it is not attached to. It cannot stop anything.

   Where: Out of band at the internet edge behind the firewall, at the data-centre core, and in front of crown-jewel segments.

   Open source: Suricata; Snort; Security Onion (Suricata + Zeek bundled)

   Commercial examples: Cisco Secure Firewall (Snort-based); Trellix Intrusion Prevention System; Trend Micro TippingPoint

   Source: NIST, OISF, Cisco, Security Onion Solutions