Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Setting Up an Intrusion Detection System: Page 6 of 8

3. Decide on location. Where you put your IDS determines whether you get data on attacks launched from outside your network or on those launched from both outside and within.

4. Get a handle on control. If you don't have a separate, secure administrative network, create one. Your production network shouldn't control the IDS and pass messages between infrastructure components.

5. Get more storage. IDS log files tend to be huge, and you'll want to retain data for more than a day or two before the log files are rewritten because of space constraints.

6. Once it's attached, be sure your IDS sees both sides of network transactions.

7. Be observant. Study your log files and learn which alerts are meaningful, so you can modify alert types, logged events, and so on, as needed.