# What are IDS and IPS?

An IDS (Intrusion Detection System) watches network traffic and raises an alert when it sees something that matches a known attack pattern. An IPS (Intrusion Prevention System) sits in the traffic path and can also block it. Many firewalls now include an IPS. Both mainly rely on signatures of known attacks, so they are strong against known threats and weaker against new methods or attackers using normal tools. An IPS that blocks wrongly also stops business traffic. NDR (Network Detection and Response) adds behaviour-based analysis. NetSenX is an NDR: it watches and alerts, and does not sit inline or block traffic itself.

FAQ: [What is…? Network and security terms](https://netsenx.com/en/faq/glossary) · https://netsenx.com/en/faq/what-are-ids-and-ips

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/problems-we-solve

## Related questions

- [What is SOAR?](https://netsenx.com/en/faq/what-is-soar)
- [What is DLP (data loss prevention)?](https://netsenx.com/en/faq/what-is-dlp-data-loss-prevention)
- [What is an audit log?](https://netsenx.com/en/faq/what-is-an-audit-log)
- [What is dwell time in cybersecurity?](https://netsenx.com/en/faq/what-is-dwell-time)
- [What are MTTD and MTTR?](https://netsenx.com/en/faq/what-are-mttd-and-mttr)