- [DevOps stage](https://about.gitlab.com/direction/#devops-stages) label: ~"devops:defend" - [Product category](https://about.gitlab.com/handbook/product/categories/#defend) label: ~"threat detection" - [Epics](https://gitlab.com/groups/gitlab-org/-/epics/?state=opened&label_name[]=runtime%20application%20security) | [Issues](https://gitlab.com/groups/gitlab-org/-/issues?state=opened&label_name[]=runtime%20application%20security&sort=milestone) ## Description Threat detection refers to the ability to detect, report, and support the ability to respond to attacks. Intrusion detection systems (IDS) is one of the multiple technologies which allow for threat detection. IDS is a device or software application that monitors a network or systems for malicious activity or policy violations. Any malicious activity or violation is typically reported either to an administrator or collected centrally using a security information and event management (SIEM) system. A SIEM system combines outputs from multiple sources and uses alarm filtering techniques to distinguish malicious activity from false alarms. IDS types range in scope from single computers to large networks. The most common classifications are network intrusion detection systems (NIDS) and host-based intrusion detection systems (HIDS). A system that monitors important operating system files is an example of a HIDS, while a system that analyzes incoming network traffic is an example of a NIDS. It is also possible to classify IDS by detection approach: the most well-known variants are signature-based detection (recognizing bad patterns, such as malware); and anomaly-based detection (detecting deviations from a model of "good" traffic, which often relies on machine learning). IDS can also have the ability to respond to detected intrusions, know also as Intrusion Protection Systems (IPS). Intrusion detection systems can also serve specific purposes by augmenting them with custom tools, such as using a honeypot to attract and characterize malicious traffic. ### Goal TODO ### Roadmap TODO ## What's Next & Why TODO ## Competitive Landscape TODO ## Analyst Landscape TODO ## Top Customer Success/Sales Issue(s) There is no feature available for this category. ## Top Customer Issue(s) The category is very new, so we still need to engage customers and get feedback about their interests and priorities in this area. ## Top Vision Item(s) TODO