IDS/IPS and threat intelligence

Goal

Enable intrusion detection, understand the difference between detect and prevent modes, and enrich decisions with threat intelligence feeds.

IDS vs IPS

• IDS (detection) — traffic matching a signature is logged and alerted, but still delivered.
• IPS (prevention) — matching traffic is dropped inline.

Run new signature sets in detection mode first, exactly like WAF policies, then promote high-confidence categories to prevention.

Signatures

Signature rules describe known attack patterns — exploit payloads, scanner fingerprints, protocol anomalies. They are grouped by category (web attacks, malware callbacks, scanning) so you can enable and tune per group.

Threat intelligence

Threat intel feeds supply lists of known-bad indicators: IP addresses, domains, URLs. ShieldGate consumes feeds through plugins and can:

• Tag requests from listed IPs with a reputation score
• Feed that score into WAF conditions (block or challenge low-reputation clients)
• Alert when internal hosts contact known-bad destinations

Steps

1. Open the IDS section, enable the baseline signature categories in detection mode.
2. Add a threat intel feed (a static feed is bundled for testing).
3. Create a WAF rule that challenges clients with poor reputation.
4. Review alerts for a few days, then move stable categories to prevention.

Verify

• A simulated scan (e.g. rapid requests to nonexistent paths) raises IDS alerts.
• Requests from an IP on the test feed carry the reputation tag in logs.

Pitfalls

• Enabling all categories in prevention mode on day one is the fastest way to drop legitimate traffic. Detect, tune, then prevent.