Intrusion Prevention System(IPS) and Its Detailed Funtion – SOC/SIEM

https://gbhackers.com/intrusion-prevention-systemips-and-its-detailed-funtion-socsiem/

Intrusion Prevention System (IPS) is a framework that screens a network for evil exercises, for example, security dangers or policy compliance.

Host intrusion prevention systems (HIPS)

A host intrusion prevention system (HIPS) is an approach to security that relies on third-party software tools to identify and prevent malicious activities

Host-based intrusion prevention systems are typically used to protect endpoint devices.

Most host intrusion prevention systems use known attack patterns, called signatures, to identify malicious activity. Signature-based detection is effective, but it can only protect the host device against known attacks.

TCP and UDP packets can or cannot carry DNS, SMTP, HTTP and other protocols

Network Intrusion Prevention System (NIPS)

A network-based intrusion prevention system (NIPS) is a system used to monitor a network as well as protect the confidentiality, integrity, and availability of a network. Its main functions include protecting the network from threats, such as denial of service (DoS) and unauthorized usage.

The NIPS monitors the network for malicious activity or suspicious traffic by analyzing the protocol activity.