Cyber Defense · lesson 9 of 12 · 12 min

Intrusion detection concepts

summary: Intrusion detection looks for suspicious activity using signatures, behavior, and context. Alerts are starting points for investigation, not automatic proof of an incident.

question: What should happen after an intrusion detection alert?

options:

• Investigate with context
• Assume it is always correct
• Delete the alert
• Disable all monitoring

correct: Investigate with context

explanation: Alerts need validation against logs, assets, and normal behavior.

---

Previous lesson: Log analysis lab
Back to Cyber Defense
Next lesson: Incident response lifecycle