What does HIDS do with detected intrusions?

What does HIDS do with detected intrusions?

• A. It logs the activity and notifies the designated authority
• B. It blocks all traffic from the source
• C. It erases all logs to maintain privacy
• D. It uploads data to the cloud only

Answer: (A)

A host-based intrusion detection system focuses on monitoring and logging activity on a single computer and then alerting when something looks suspicious. It keeps an audit trail of events like unusual logins, unexpected file changes, or odd process behavior, so you have the evidence needed for investigation. When it detects a potential intrusion, it notifies the designated authority or security team (often feeding alerts to a SIEM) to enable a rapid response. This combination of detection, logging, and alerting is what makes HIDS valuable for post-incident analysis and ongoing protection. The other options don’t fit because blocking all traffic from a source is the job of a firewall or an intrusion-prevention system, not a host-based detector that emphasizes observation and alerting. Erasing logs would defeat the purpose of monitoring and forensics, and uploading data to the cloud only isn’t the primary function of HIDS.

A host-based intrusion detection system focuses on monitoring and logging activity on a single computer and then alerting when something looks suspicious. It keeps an audit trail of events like unusual logins, unexpected file changes, or odd process behavior, so you have the evidence needed for investigation. When it detects a potential intrusion, it notifies the designated authority or security team (often feeding alerts to a SIEM) to enable a rapid response. This combination of detection, logging, and alerting is what makes HIDS valuable for post-incident analysis and ongoing protection.

The other options don’t fit because blocking all traffic from a source is the job of a firewall or an intrusion-prevention system, not a host-based detector that emphasizes observation and alerting. Erasing logs would defeat the purpose of monitoring and forensics, and uploading data to the cloud only isn’t the primary function of HIDS.