Intrusion and extrusion types

The intrusion detection system detects many types of intrusion and extrusion events.

Attack events
Attack policies monitor for various types of attacks against the system. Your system can be attacked or used as the source of an attack. When IDS detects an attack, it writes an intrusion event to the audit record.
Extrusion events
An extrusion is an attack, traffic regulation, or scan event that originates from the local host system against a remote system. For example, a trusted insider might use a company machine as the origin of a denial-of service attack. An extrusion also is called an outbound intrusion.
Scan events
A scan is an attack that attempts to connect to unused ports looking for a way to break into the system. A scan also can be a connection request from a spoofed IP address. After the open ports are discovered, the hacker tries to discover the weaknesses and gain access to the system.
Traffic regulation events
Traffic regulation policies monitor the established TCP connections, User Datagram Protocol (UDP) errors, and System SSL/TLS failed handshakes. The policies can be configured on all or specific IP addresses and ports.
Variable dynamic throttling
You can specify variable dynamic throttling in each intrusion detection (IDS) policy. If an enabled IDS policy has throttling specified, throttling occurs after a suspected intrusion or extrusion has occurred and certain thresholds have been reached. Variable dynamic throttling starts discarding packets when a threshold has been exceeded within a given statistics or scan interval.

Parent topic: Intrusion detection concepts